{"schema_version":"0.10.0","id":"LR-2026-0548","record_version":1,"title":"Yankton Boys & Girls Club deepfake bank fraud","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":42.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":1.92,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"cb8442e1d235bdba3ec0f5d349c157e0060f77a9672d467499ad8b363fde74a6"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-05-13","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"The Boys & Girls Club of the Northern Plains, Yankton Club, suffered a loss from an AI-assisted fraud in April. An unidentified person or group acquired login credentials and used AI-generated voice cloning, spoofed phone numbers and manipulated transaction details to access one of the organisation's bank accounts. Leadership became aware of the theft on May 1, when the attackers made a second attempt to withdraw funds and the transaction was flagged. The organisation says no client or donor data was compromised. Law enforcement has been contacted and the incident remains under investigation.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Test: minor (contained to one deployer, no third party touched). Fact: the organization says no client or donor data was compromised, and the loss was to one organisation's bank account.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.dakotanewsnow.com/2026/05/13/yankton-boys-girls-club-loses-200000-ai-powered-cyberattack/","publisher":"Dakota News Now","date":"2026-05-13","type":"press","title":"Yankton Boys & Girls Club loses $200,000 in AI-powered cyberattack - Dakota News Now","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"event.incident_class":"C","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"According to the organization, an unidentified person or group conducted a “deepfake fraud” in which attackers acquired login credentials and used AI-generated voice cloning, spoofed phone numbers, and manipulated transaction details to access one of the organization’s bank accounts."}],"impact.severity":[{"source_index":0,"quote":"The organization says no client or donor data was compromised."}],"impact.severity_because":[{"source_index":0,"quote":"The organization says no client or donor data was compromised."}],"event.summary":[{"source_index":0,"quote":"The Boys & Girls Club of the Northern Plains - Yankton Club suffered a major loss due to an AI-powered online cyberattack in April."},{"source_index":0,"quote":"According to the organization, an unidentified person or group conducted a “deepfake fraud” in which attackers acquired login credentials and used AI-generated voice cloning, spoofed phone numbers, and manipulated transaction details to access one of the organization’s bank accounts."},{"source_index":0,"quote":"Boys & Girls Club leadership became aware of the theft on May 1 when the cyberattackers made a second attempt to withdraw funds, but the transaction was flagged."},{"source_index":0,"quote":"The organization says no client or donor data was compromised."},{"source_index":0,"quote":"Law enforcement has been contacted, and the incident remains under investigation."}]},"notes_on_gaps":"The sources do not name the AI system, model, developer, or any deployed agent; the incident is described as attacker use of AI voice cloning against a human-run bank process, so system fields are omitted. The $200,000 figure appears only in the headline supplied with the request, not in the source body, so no loss amount is recorded. No record count, affected-party count, or remediation hours are stated. Date of disclosure is not stated in a sentence (the article date is metadata only) so it is omitted. The year for the May 1 detection is taken as 2026 from the article date, a judgement. agent_involved set to false and adversarial_actor set to unknown are judgements from the description of an unidentified person or group. Trigger, root cause, responsible party, detection method and country are not stated and are omitted. No source states which controls held, failed or were missing; the transaction flag is noted but not mapped to a control id, so no links are recorded. No remediation is reported. Severity minor is a judgement based on the statement that no client or donor data was compromised. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"The attackers acquired login credentials and manipulated transaction details, and the organisation's account was accessed.","quote":"According to the organization, an unidentified person or group conducted a “deepfake fraud” in which attackers acquired login credentials and used AI-generated voice cloning, spoofed phone numbers, and manipulated transaction details to access one of the organization’s bank accounts.","source_index":0,"grade":"C"},{"step":"done","text":"Law enforcement has been contacted and the incident remains under investigation.","quote":"Law enforcement has been contacted, and the incident remains under investigation.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.dakotanewsnow.com/2026/05/13/yankton-boys-girls-club-loses-200000-ai-powered-cyberattack/"]},"analysis":{"sections":{"timeline":[{"text":"Law enforcement was contacted and the incident remains under investigation.","quote":"Law enforcement has been contacted, and the incident remains under investigation.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.dakotanewsnow.com/2026/05/13/yankton-boys-girls-club-loses-200000-ai-powered-cyberattack/"]}}