HackingFinancial ServicesFinanceSQL InjectionCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDPIICriticalContained

Catholic United Financial

bd_095ea08906d84f19 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Sep 6, 2017

Filed

Oct 6, 2017

To disclose

4 weeks

Affected

127,310

Linked

6 filings

Confidence

64%

Full breach record for Catholic United Financial →

Catholic United Financial experienced an SQL injection attack on its web server, potentially exposing personal information including Social Security numbers for approximately 127,310 members. The intrusion occurred on November 12, 2016, but was not discovered until September 6, 2017. The organization shut down its website, engaged forensic investigators, and notified law enforcement. Affected individuals were offered two years of identity monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 6, 2017 → Notified Feb 8, 2018155d ✗ CA 60-day late4 weeks discovery → filing

Incident timeline

undetected · 298 days

discovery → filing · 4 weeks / 30 days

Nov 12, 2016

Begins

Sep 6, 2017

Discovered

Oct 6, 2017

Filed

vs. sector median

5 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_163b0a2490838b832017-10-06Candidate
Washington State AGbd_8e14bc01857077232017-10-06Verified by operator
New Hampshire State AGbd_444411c792158acf2017-10-05 · +1dVerified
Massachusetts State AGbd_d98cc38a86f2cabd2017-10-12 · +6dVerified

Show 1 more filing ↓up to 7d gap

Oregon State AGbd_a56592d36390de292017-10-13 · +7dVerified by operator

Name: Catholic United Financial
norm: catholic united financial

Name: Catholic United Financial
norm: catholic united financial
Industry: Financial Servicesllm

Discovered: Sep 6, 2017
Breach occurred: Nov 12, 2016
Undetected for: 298 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 8, 2018
Affected individuals: 127,310nationwide
Data types: Identity (basic)Government IDPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified the Ramsey County, Minnesota sheriffNotified the FBI
Initial access: exploit_public_facing

During the incident: Took action to completely shut down our website
Hired an outside forensic team to investigate
Removed all potential access to personally identifiable information on its web server
Secured the web server from any possible further intrusion
Notified the Ramsey County, Minnesota sheriff
Notified the FBI
Cooperating in their investigations
Changes made: Hardening its security with the help of outside experts
Restoring online services only after hardening has been completed
Providing identity monitoring at no cost for two years through Kroll
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: CA 60-day late · 155d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 6, 2017
→ Notified: Feb 8, 2018
155d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 6, 2017 → Notified: Feb 8, 2018	155d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGOct 5 · first

Montana State AG+1d

Washington State AG+1d

California State AG+1d · this page

Massachusetts State AG+7d

Oregon State AG+8d

Pattern: first filing Oct 5 (NH), last Oct 13 (OR) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-102483
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 6, 2017
Raw hash: b2d412aef60425e2136ee98a28932182962cebc1a12967561f23ddd08ad5352c

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCatholic United Financial

Victim entityCatholic United Financial

Incidentdiscovered Sep 6, 2017

Stated responseTook action to completely shut down our website

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov