MalwareFinancial ServicesFinanceRansomwareRansom DemandedTargetedIdentity (basic)Government IDFinancial accountMediumContained

Title Guaranty Company of Lewis County

bd_0918069faa0bc0c9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 1, 2021

Filed

Jan 21, 2022

To disclose

16 weeks

Affected

2state residents only

Linked

3 filings

Confidence

64%

Full breach record for Title Guaranty Company of Lewis County →

Title Guaranty Company of Lewis County and Coast Title & Escrow, Inc. disclosed a ransomware attack in late October 2021. The incident compromised personal information including names, SSNs, dates of birth, bank account info, and driver's license numbers. The company shut down systems, engaged forensic investigators, notified law enforcement, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 weeks / 112 days

Oct 1, 2021

Begins

Oct 1, 2021

Discovered

Jan 21, 2022

Filed

vs. sector median

+8 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_8b68f25fbf0a628f2022-01-14 · +7dVerified
Washington State AGbd_33c30dab759fb32a2021-12-09 · +43dCandidate

Name: Title Guaranty Company of Lewis County
norm: title guaranty company of lewis county

Name: Title Guaranty Company of Lewis County
norm: title guaranty company of lewis county
Industry: Financial Servicesllm

Discovered: Oct 1, 2021
Breach occurred: Oct 1, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: phishing_link

During the incident: Shut down computer systems and internet connections
Retained a nationally recognized cybersecurity forensic firm to conduct a thorough investigation
Notified law enforcement
Changes made: Examined each component of our systems carefully before being returned to operation
Removed or thoroughly cleaned potentially impacted equipment
Restored data files from backup
Installed more threat monitoring equipment
Strengthening defenses against future attacks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(112 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Washington State AGDec 9 · first

Indiana State AG+36d

Montana State AG+43d · this page

Pattern: first filing Dec 9 (WA), last Jan 21 (MT) — a 43-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-195.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 21, 2022
Raw hash: 05aeaf34656401553ccdd4ac5188c789a84b7ab2da22fda4b8c8bf6a60fbb566

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTitle Guaranty Company of Lewis County

Victim entityTitle Guaranty Company of Lewis County

Incidentdiscovered Oct 1, 2021

Stated responseShut down computer systems and internet connections

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov