Social EngineeringOtherPhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryAuthenticationBiometricCredentialsFinancialFinancial accountHealth (basic)Identity (basic)Government IDPHIMediumContained

Cougar Den, Inc.

bd_050c9e3c949102b4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 28, 2021

Filed

May 10, 2021

To disclose

15 weeks

Affected

757state residents only

Linked

2 filings

Confidence

70%

Full breach record for Cougar Den, Inc. →

Cougar Den, Inc. notified Washington AG of a phishing incident affecting 757 residents. Unauthorized access to email accounts occurred Nov 2020–Feb 2021. Data exposed included names, SSNs, driver's licenses, financial/medical info, and credentials. Notice sent May 7, 2021. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d15 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 88 days

discovery → filing · 15 weeks / 102 days

Nov 1, 2020

Begins

Jan 28, 2021

Discovered

May 10, 2021

Filed

vs. sector median

+7 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_4d9cc06edbfcd70c2021-05-07 · +3dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Cougar Den, Inc.
norm: cougar den
Industry: Otherllm

Discovered: Jan 28, 2021
Breach occurred: Nov 1, 2020 – Feb 1, 2021
Undetected for: 88 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 7, 2021
Affected individuals: 757state-resident count only
Data types: AuthenticationBiometricCredentialsFinancialFinancial accountHealth (basic)Identity (basic)Government IDPHI
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthPassport numberMedical informationBiometric dataUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Office of the Attorney General
Initial access: phishing_link

During the incident: Worked with outside specialists to investigate the nature and scope of the activity
Reviewed email messages and file attachments stored within the impacted accounts
Secured the compromised accounts
Provided access to credit monitoring services for twelve (12) months, through Experian
Changes made: Implementing additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(102 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGMay 7 · first

Washington State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10464.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 10, 2021
Raw hash: 8241558b208db71883f2a5d2ce405293e4795474ad89b8257b443d07580044fd

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityCougar Den, Inc.

Incidentdiscovered Jan 28, 2021

Stated responseWorked with outside specialists to investigate the nature and scope of the activity

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com