Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability, Data Leak, Ransomware and Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with fixed vulnerability, and communication strategy with informed concerned third parties and data protection authorities, and containment measures with adoption of additional security measures, containment measures with password resets, and communication strategy with customer alerts, and third party assistance with avast, and and remediation measures with protections against byovd tactics..

Common Attack Types: The most common types of attacks the company has faced is Data Leak.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Compromised Credentials from Another Source and Vulnerable Avast Anti-Rootkit driver.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Email Addresses, Communication Preferences, , Usernames, Email Addresses, Password Hashes, , Personal Information, , Personally Identifiable Information, , Usernames, Passwords, First Names, Last Names, Phone Numbers, Mailing Addresses and .

Third-Party Assistance: The company involves third-party assistance in incident response through Avast.

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Protections against BYOVD tactics, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by fixed vulnerability, , adoption of additional security measures, password resets and .

Key Lessons Learned: The key lessons learned from past incidents are Importance of protecting systems against kernel-level threats posed by flawed security drivers.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Vermont Office of the Attorney GeneralDate Accessed: 2023-01-09.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Informed Concerned Third Parties And Data Protection Authorities and Customer Alerts.

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Avast.

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Protections against BYOVD tactics.

Last Attacking Group: The attacking group in the last incident were an DoNex Ransomware and Unauthorized third parties.

Most Recent Incident Detected: The most recent incident detected was on 2014-05-01.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2023-01-09.

Most Significant Data Compromised: The most significant data compromised in an incident were Email Addresses, Communication Preferences, , usernames, email addresses, password hashes, , Names, Residences, Dates of birth, Corporate email addresses, , First and Last Names, Phone Numbers, Mailing Addresses, , usernames, passwords, first names, last names, phone numbers, mailing addresses and .

Most Significant System Affected: The most significant system affected in an incident was Web Application and Forum and Norton Password Manager and Various security products from multiple companies.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was Avast.

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Fixed Vulnerability and Adoption of Additional Security MeasuresPassword Resets.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were usernames, Phone Numbers, Names, Email Addresses, First and Last Names, Dates of birth, last names, mailing addresses, password hashes, passwords, Residences, Mailing Addresses, phone numbers, email addresses, first names, Corporate email addresses and Communication Preferences.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 1.4K.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Importance of protecting systems against kernel-level threats posed by flawed security drivers.

Most Recent Source: The most recent source of information about an incident is Vermont Office of the Attorney General.

Most Recent Entry Point: The most recent entry point used by an initial access broker were an Compromised Credentials from Another Source and Vulnerable Avast Anti-Rootkit driver.