Van Wagner Group breach exposed Social Security numbers of 5,354 people

Van Wagner Group, a New York sports and entertainment advertising agency, disclosed in late 2024 that a malware attack had exposed personal information belonging to thousands of people. In a notification filed with the Maryland Office of the Attorney General on November 1, 2024, counsel for the company said Van Wagner learned on August 27, 2024 that its systems had been compromised.

The investigation placed the intrusion between August 3 and September 4, 2024. The company said the root cause was never confirmed but that the attack may have been carried out through a VPN interface. Van Wagner did not finish identifying which files were involved until September 9, 2024, and then spent several weeks matching those records to individuals, confirming addresses and standing up a call center.

According to the regulatory filing, the exposed data could include names, addresses, email addresses, dates of birth and Social Security numbers. Van Wagner put the total at 5,354 individuals, of whom 126 lived in Maryland.

The company began mailing notification letters on October 31, 2024 and offered recipients 12 months of credit monitoring and identity theft protection at no cost through Equifax Credit Watch Gold. Van Wagner also told regulators it had changed system passwords, strengthened authentication and firewall controls, added tools intended to detect and stop future attacks, and improved system monitoring.