MalwareProfessional ServicesProfessional ServicesRansomwareStolen CredentialsData ExfiltratedMulti-Stage ChainDelayed DiscoveryHealth (basic)Identity (basic)Government IDPHIHighActive

Morley Companies, Incorporated

bd_0231bc3362ac2b5a · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 1, 2021

Filed

Mar 21, 2022

To disclose

33 weeks

Affected

42,633state residents only

Linked

15 filings

Confidence

71%

Full breach record for Morley Companies, Incorporated →2 incidents on file

Morley Companies, Inc. reported a ransomware incident affecting approximately 42,633 Washington residents. Unauthorized access occurred between July 20 and September 2, 2021, with discovery on August 1, 2021. Personal information including SSNs, DOBs, driver's licenses, and health data was compromised. Morley engaged forensic experts, notified the FBI, and provided 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d33 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 12 days

discovery → filing · 33 weeks / 232 days

Jul 20, 2021

Begins

Aug 1, 2021

Discovered

Mar 21, 2022

Filed

vs. sector median

+14 wks slower

This filing is one of 15 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

California State AGbd_15c18691b2f9b9ac2022-03-21Verified
New Hampshire State AGbd_98bdafd57d957cf12022-03-21Verified
Oregon State AGbd_847199de573933002022-02-08 · +41dVerified
California State AGbd_1a3787d24bb59c4e2022-02-01 · +48dVerified

Show 6 more filings ↓up to 54d gap

New Hampshire State AGbd_7950612a8c90a7432022-02-01 · +48dVerified
Maine State AGbd_a6ad4289c8bc0ba52022-02-01 · +48dVerified
HHS OCRbd_c62c3bad868a53b82022-02-01 · +48dVerified
South Carolina State AGbd_2116a0563276834a2022-01-27 · +53dVerified
Massachusetts State AGbd_0e5c0f27525f38df2022-01-26 · +54dVerified
Montana State AGbd_1f725c594085ad562022-01-26 · +54dVerified

Showing first 10 of 14 linked disclosures.

Name: Morley Companies, Incorporated
norm: morley companies
Domain: morleycompanies.com

Name: Morley Companies, Incorporated
norm: morley companies
Domain: morleycompanies.com
Industry: Professional Servicesllm

Discovered: Aug 1, 2021
Breach occurred: Jul 20, 2021 – Sep 2, 2021
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 21, 2022
Affected individuals: 42,633state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: NameSocial Security numberDriver's licence numberDate of birthHealth insurance IDMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the FBI of this incident and are working with them in any resulting investigation
Initial access: valid_credentials

During the incident: Engaged cybersecurity experts to assist with the investigation
Notified the FBI of this incident and are working with them in any resulting investigation
Providing impacted individuals with information about steps they can take to help protect their personal information
Offering credit monitoring and identity protection services at no cost through IDX
Changes made: Made alterations to its cyber environment to help prevent similar incidents from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(232 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 9 states

View merged incident ↗

Massachusetts State AGJan 26 · first

Montana State AGJan 26 · first

South Carolina State AG+1d

California State AG+6d

New Hampshire State AG+6d

Maine State AG+6d

HHS OCR+6d

Oregon State AG+13d

California State AG+54d

New Hampshire State AG+54d

Washington State AG+54d · this page

Pattern: first filing Jan 26 (MA), last Mar 21 (WA) — a 54-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 14 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA6398.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 21, 2022
Raw hash: 20794a51eebfb46e3e46b4ce8a647a9573d24a99058e90fd3b492462fce7f5b1

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityMorley Companies, Incorporated

Victim entityMorley Companies, Incorporated

Incidentdiscovered Aug 1, 2021

Stated responseEngaged cybersecurity experts to assist with the investigation

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com