The Elephant Sanctuary in Tennessee

The Vermont Office of the Attorney General disclosed a data breach affecting The Elephant Sanctuary in Tennessee on October 25, 2022. The incident stemmed from unauthorized access to an employee’s email account, suspected to have occurred around July 12, 2022. While the exact scope of compromised data remains partially unspecified, the breach exposed personal information, including first and last names of individuals likely employees or associated parties. Authorities confirmed no evidence of misuse of the accessed data, suggesting the attack did not escalate into broader exploitation like identity theft or financial fraud. The breach highlights vulnerabilities in email security protocols, potentially linked to phishing or credential compromise, though the method of intrusion was not detailed. The sanctuary, a nonprofit organization dedicated to elephant welfare, faced reputational risks due to the exposure of sensitive internal communications or personnel records. The lack of reported misuse mitigates immediate harm but underscores the need for strengthened cybersecurity measures to prevent future incidents targeting employee accounts.

Source: https://ago.vermont.gov/document/2022-10-25-elephant-sanctuary-tenessee-data-breach-notice-consumers

TPRM report: https://www.rankiteo.com/company/globalsanctuaryforelephants

"id": "glo1001091725",
"linkid": "globalsanctuaryforelephants",
"type": "Breach",
"date": "7/2022",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'industry': 'Animal welfare / Conservation',
                        'location': 'Tennessee, USA',
                        'name': 'The Elephant Sanctuary in Tennessee',
                        'type': 'Non-profit organization'}],
 'attack_vector': 'Unauthorized access to employee email account',
 'data_breach': {'data_exfiltration': 'Potential (unconfirmed)',
                 'personally_identifiable_information': ['First names',
                                                         'Last names'],
                 'sensitivity_of_data': 'Moderate (personal identifiers)',
                 'type_of_data_compromised': ['Personal information (names)',
                                              'Unspecified data elements']},
 'date_detected': '2022-07-12',
 'date_publicly_disclosed': '2022-10-25',
 'description': 'The Vermont Office of the Attorney General reported a data '
                'breach involving The Elephant Sanctuary in Tennessee on '
                'October 25, 2022. The breach involved potential unauthorized '
                'access to an employee email account on or around July 12, '
                '2022, possibly compromising personal information including '
                'first and last names and other unspecified data elements. No '
                'indication of misuse of the information has been reported.',
 'impact': {'data_compromised': ['First names',
                                 'Last names',
                                 'Unspecified data elements'],
            'identity_theft_risk': 'Potential (no misuse reported)',
            'systems_affected': ['Employee email account']},
 'initial_access_broker': {'entry_point': 'Employee email account'},
 'investigation_status': 'Ongoing (no misuse reported as of disclosure)',
 'references': [{'date_accessed': '2022-10-25',
                 'source': 'Vermont Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': ['Vermont Office of the '
                                                        'Attorney General']},
 'response': {'communication_strategy': 'Public disclosure via Vermont Office '
                                        'of the Attorney General'},
 'title': 'Data Breach at The Elephant Sanctuary in Tennessee',
 'type': 'Data Breach'}