HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountPCIMediumContained

Niibin, LLC

bd_0436e48657f304ec · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 15, 2020

Filed

Oct 5, 2020

To disclose

20 days

Affected

3state residents only

Linked

4 filings

Confidence

66%

Full breach record for Niibin, LLC →

Niibin, LLC dba Cash Aisle notified Montana residents of a data breach involving its third-party call center provider, Preferred Call Services. On September 15, 2020, the provider's email accounts were compromised, potentially exposing customer PII, SSNs, driver's licenses, and financial data. The provider reset passwords, engaged forensic investigators, and implemented security changes. Cash Aisle offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 20 days

Sep 15, 2020

Discovered

Oct 5, 2020

Filed

vs. sector median

6 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_19e07a3955bb9eef2020-10-05Verified
New Hampshire State AGbd_4ff8c1f73cb42a992020-10-14 · +9dVerified
Maine State AGbd_466b86e5286735c72020-10-30 · +25dVerified by operator

Name: Niibin, LLC
norm: niibin

Name: Niibin, LLC
norm: niibin
Also named: Niibin, LLCdba oflegal entity
Cash Aisledba oftrade name
Industry: Financial Servicesllm

Discovered: Sep 15, 2020
Materiality determined: —
Notification sent: Oct 5, 2020
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial accountPCI
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Third party: via Preferred Call Services
Initial access: valid_credentials

During the incident: PCS changed the passwords of its email accounts
PCS performed scans on all of its computer systems
PCS updated its domain and user level settings
PCS performed additional computer security changes
PCS engaged a third party cybersecurity firm to manually analyze the impacted information
Cash Aisle is working to minimize the impact of the incident and identify additional actions
Changes made: PCS engaged a third party cybersecurity firm to manually analyze the impacted information
PCS took additional measures and corrective actions to remediate and mitigate the effects of this incident
Cash Aisle will make necessary adjustments to help ensure the security of your data going forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGOct 5 · first

Montana State AGOct 5 · first · this page

New Hampshire State AG+9d

Maine State AG+25d

Pattern: first filing Oct 5 (IN), last Oct 30 (ME) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/cashSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 5, 2020
Raw hash: c6f2f49a02bf41867c05856dd2c05a817220ec662a179f71dcfd236bffb5aca7

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityNiibin, LLC

Victim entityNiibin, LLC

Incidentdiscovered Sep 15, 2020

Stated responsePCS changed the passwords of its email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov