MalwareFinancial ServicesFinanceRansomwareData ExfiltratedData EncryptedRansom DemandedIdentity (basic)Government IDMediumContained

CNA FINANCIAL CORPORATION

bd_107e3f0f52c95ee9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 21, 2021

Filed

Jul 9, 2021

To disclose

16 weeks

Affected

74state residents only

Linked

9 filings

Confidence

63%

Full breach record for CNA FINANCIAL CORPORATION →

CNA Financial Corporation notified Montana residents of a ransomware attack discovered on March 21, 2021. The threat actor accessed systems between March 5-21, 2021, copying limited personal information (name, SSN) before deploying ransomware. CNA recovered the data, found no evidence of misuse, and reported the incident to the FBI. Affected individuals were offered 24 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 16 days

discovery → filing · 16 weeks / 110 days

Mar 5, 2021

Begins

Mar 21, 2021

Discovered

Jul 9, 2021

Filed

vs. sector median

+7 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Oregon State AGbd_8f8adf6678098d272021-07-09Verified
Indiana State AGbd_eb7c4eb9cabf7a572021-07-09Verified
California State AGbd_2498cf3d61584cfe2021-07-08 · +1dCandidate
Massachusetts State AGbd_53180e7c81f57e152021-07-08 · +1dVerified

Show 4 more filings ↓up to 3d gap

HHS OCRbd_641fa664e7fa983f2021-07-08 · +1dVerified
Maine State AGbd_7abcb947b9a916802021-07-08 · +1dVerified
Washington State AGbd_7f8a3a5d1d0c1ff62021-07-08 · +1dVerified
New Hampshire State AGbd_bdd258432c11e6292021-07-12 · +3dVerified

Name: CNA FINANCIAL CORPORATION
norm: cna financial
Domain: cna.com

Name: CNA FINANCIAL CORPORATION
norm: cna financial
Domain: cna.com
Industry: Financial Servicesllm

Discovered: Mar 21, 2021
Breach occurred: Mar 5, 2021 – Mar 21, 2021
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 9, 2021
Affected individuals: 74state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: reported the incident to, and is working closely with, the appropriate law enforcement authorities, including the FBI

During the incident: Retained leading cybersecurity firms to assist in responding and help conduct a thorough investigation
Reported the incident to, and is working closely with, the appropriate law enforcement authorities, including the FBI
Changes made: Implemented numerous additional measures designed to enhance the security of our network, systems, and data
Offering a complimentary 24 month membership of Experian’s® IdentityWorksSM
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(110 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

California State AGJul 8 · first

Massachusetts State AGJul 8 · first

HHS OCRJul 8 · first

Maine State AGJul 8 · first

Washington State AGJul 8 · first

Oregon State AG+1d

Indiana State AG+1d

Montana State AG+1d · this page

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/a-notif-70.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 9, 2021
Raw hash: e091a8f0314896ff1e3c435d5f2192f26c931618bbd425ca0f6d8aeed68243fd

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityCNA FINANCIAL CORPORATION

Victim entityCNA FINANCIAL CORPORATION

Incidentdiscovered Mar 21, 2021

Stated responseRetained leading cybersecurity firms to assist in responding and help conduct a thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov