The American College of Toxicology has notified speakers and attendees of its events about a data incident at Cadmium, the vendor behind the Eventscribe event application the organization used. The notice says an unauthorized third party downloaded contact information that attendees and exhibitors had placed in the app.
The notice was posted by the Massachusetts Attorney General. It describes an incident at a vendor rather than at the College itself, but organizations that collect information from their members and event participants remain responsible for choosing vendors that protect it.
American College of Toxicology’s Data Breach Investigation
The American College of Toxicology is a professional society for toxicologists, and like many professional groups it hosts conferences and relies on an outside company to run the event app that attendees use for schedules, speaker details, and networking. According to the notice, the company that manages the College’s event application, Cadmium, determined that an unauthorized third party accessed certain public-facing Eventscribe data files and downloaded attendee and exhibitor contact information tied to the affected events.
The College says the activity was limited to retrieving event data files. It reports that Cadmium told it that no internal systems, account credentials, or backend infrastructure were compromised. In other words, the notice describes data that could be reached through files exposed to the public side of the application rather than a break-in to a private network. That distinction matters because it suggests the problem was how the data files were made available, not a theft of passwords.
The Massachusetts filing list shows that 274 Massachusetts residents were affected. That number is specific to Massachusetts. The College’s notice is addressed to speakers and attendees generally and does not give a total, so people in other states may also have been affected, and this page does not claim a nationwide figure.
The notice describes several steps that Cadmium took after the incident. It says the vendor completed an independent forensic investigation with third-party experts and reported the matter to the FBI Internet Crime Complaint Center. It also says the vendor removed the downloadable attendee data files and the scripts that generated them, removed email addresses and phone numbers from the application services that supply speaker, presenter, and attendee information, and routed application traffic through a managed API gateway with enhanced logging. Finally, it says the vendor now requires valid login credentials and per-user, per-event authorization for event data requests, and applies rate limits while it monitors for unusual access patterns.
Those fixes are informative. Removing downloadable files, adding authorization checks, and limiting request rates are the sorts of controls that are typically used to stop bulk scraping of data. They suggest the exposed files could be retrieved in bulk without the kind of login and per-person permission checks that now apply. The notice does not say how long the files were reachable, how many events were involved, or whether the vendor can show which files were actually downloaded.
Contact details gathered at conferences are more valuable to criminals than they may look. A list of names, work titles, employers, email addresses, and cell phone numbers, tied to a specific scientific meeting, is an ideal starting point for targeted phishing and text scams. A message that mentions a real conference, a real colleague, or a real speaker is much more believable than a generic spam email. The notice itself warns that the information could be used to build convincing impersonation messages, such as an email claiming to come from the College, one of its events, or a vendor and asking for payment or offering attendee lists or event services.
For readers trying to judge the risk, the key points are these. The information is contact and profile data rather than financial data. The College says passwords and payment details were not part of the incident. The notice does not describe any offer of credit monitoring. Because the data is the sort that fuels impersonation and phishing, the practical risk is more likely to come from fraudulent messages than from direct account takeover.
The event app incident also shows a wider pattern. Organizations of every size hand attendee data to third-party platforms, and a single weakness at one platform can touch many events and many organizations at once. People who register for a conference rarely know which vendor holds their information or how it is protected, which is part of why notices like this one matter.
When Did This Breach Occur?
The notice does not give a date for the incident, a date when the vendor discovered it, or the period during which the files could be reached. It was posted on the Massachusetts Attorney General’s list of data breach notification letters.
The College says the vendor has completed its forensic investigation. The notice does not say when that investigation began or ended.
What Information Was Breached?
According to the notice, the information potentially involved is event registration and profile information that a person may have chosen to share in the app. It lists an account ID, first and last name, email address, position or title and organization name, city, state, and country, and cell phone number.
It also lists a profile biography, social media and website links, a profile-share count, the account creation date, and event-specific custom data fields. The notice states that the incident did not involve payment information, passwords, account credentials, or other sensitive personal or financial information.
What You Can Do
If you spoke at or attended a College event, consider the following steps.
- Treat unexpected emails and texts that mention the College, a conference, or an event vendor with caution, and check the sender’s full email address, not just the display name.
- Hover over links to check the web address before clicking, and never make a payment or share financial details in response to an unexpected message.
- If you are unsure whether a message is real, contact the College through an email address or phone number you already know.
- Consider placing a free fraud alert or security freeze with Equifax, Experian, and TransUnion, and review your credit reports at annualcreditreport.com.
- Report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov, and keep a copy of your notice.
File a Data Breach Lawsuit Against American College of Toxicology
People whose personal information is exposed in a data security incident may have legal options if the organization or its vendor did not use reasonable safeguards to protect it. Whether a claim exists depends on the facts, including what information was involved, how the incident happened, and how the organizations responded.
If you received a notice connected to the American College of Toxicology, you can speak with a lawyer about whether you may be able to join a class action lawsuit to seek compensation for the exposure of your information, the time you spent responding, and any losses you suffered.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
