Incident Types: The types of cybersecurity incidents that have occurred include Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an incident response plan activated with yes (investigation initiated post-discovery), and recovery measures with notification letters mailed (2025-09-22), recovery measures with website notice published, and communication strategy with mail notifications to affected individuals, communication strategy with website notice, communication strategy with offer of free credit monitoring/identity protection services (if applicable)..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Employee Email Accounts.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personally Identifiable Information (Pii), Financial Data, Medical/Health Information, Authentication Credentials and .

Incident Response Plan: The company's incident response plan is described as Yes (investigation initiated post-discovery).

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Notification letters mailed (2025-09-22), Website notice published, .

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Potential class-action lawsuits (investigation by Shamis & Gentile P.A.).

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Shamis & Gentile P.A. Investigation Notice.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Mail Notifications To Affected Individuals, Website Notice and Offer Of Free Credit Monitoring/Identity Protection Services (If Applicable).

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Mail Notifications To Affected Individuals, Website Notice, Review And Save Notification Letters, Enroll In Credit Monitoring Services, Monitor Accounts For Unauthorized Activity, Consider Fraud Alerts/Credit Freezes, Seek Legal Help For Compensation and .

Last Attacking Group: The attacking group in the last incident was an Unauthorized Actor (Unknown).

Most Recent Incident Detected: The most recent incident detected was on 2025-03-17.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-09-22.

Most Significant Data Compromised: The most significant data compromised in an incident were Full name, Social Security number, Date of birth, U.S. driver license number, Financial account number, Financial account access information, Payment card number, Payment card access information, Passport number, Electronic signature, Medical information, Health insurance information and .

Most Significant System Affected: The most significant system affected in an incident was Employee Email Accounts.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Financial account access information, Electronic signature, Date of birth, Health insurance information, Payment card number, U.S. driver license number, Payment card access information, Passport number, Social Security number, Medical information, Financial account number and Full name.

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Potential class-action lawsuits (investigation by Shamis & Gentile P.A.).

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Seek legal counsel for compensation claims, Enroll in free credit monitoring/identity protection services if offered, Place a fraud alert with credit bureaus, Request free annual credit reports and Monitor financial accounts for suspicious activity.

Most Recent Source: The most recent source of information about an incident is Shamis & Gentile P.A. Investigation Notice.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (as of 2025-09-22, notifications sent).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Mail notifications to affected individuals, Website notice, .

Most Recent Customer Advisory: The most recent customer advisory issued was an Review and save notification lettersEnroll in credit monitoring servicesMonitor accounts for unauthorized activityConsider fraud alerts/credit freezesSeek legal help for compensation.

Most Recent Entry Point: The most recent entry point used by an initial access broker was an Employee Email Accounts.