Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

Mezrah Financial

bd_155b5bfa122e7f72 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 8, 2019

Filed

Dec 2, 2019

To disclose

21 weeks

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Mezrah Financial →2 incidents on file

Mezrah Financial, an affiliate of M Holdings Securities, reported unauthorized access to employee email accounts between July 1-18, 2019. Discovered July 8, 2019, the incident affected personal information including names and driver's license numbers. One New Hampshire resident was notified on November 22, 2019, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

discovery → filing · 21 weeks / 147 days

Jul 1, 2019

Begins

Jul 8, 2019

Discovered

Dec 2, 2019

Filed

vs. sector median

+12 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_4c3c140bf8998b7a2019-12-09 · +7dVerified

Name: M Holdings Securities, Inc.
norm: m holdings securities

Name: Mezrah Financial
norm: mezrah financial
Also named: M Holdings Securities, Inc.operating subsidiary ofholding company
Industry: Financial Servicesllm

Discovered: Jul 8, 2019
Breach occurred: Jul 1, 2019 – Jul 18, 2019
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 22, 2019
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: phishing_link

During the incident: Disabled access to the account
Began an investigation
Worked with a digital forensics firm
Provided individual notification
Providing the notified individual 12 months of credit and identity monitoring services at no charge
Worked with and provided assistance to law enforcement
Changes made: Enhanced security within its email platform
Enhanced password complexity
Enhanced audit logging
Enhanced general information security practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(147 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGDec 2 · first · this page

Massachusetts State AG+7d

Pattern: first filing Dec 2 (NH), last Dec 9 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/m-holdings-securities-20191202.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 2, 2019
Raw hash: 60cdeeb33c9e65fcabed1e8a063eafa1e4ec63a59c03333c6e83f408102caa16

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityM Holdings Securities, Inc.

Victim entityMezrah Financial

Incidentdiscovered Jul 8, 2019

Stated responseDisabled access to the account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov