HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

CALTON & ASSOCIATES, INC.

bd_15ff45acc8e418c6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 28, 2025

Filed

Jun 26, 2025

To disclose

13 weeks

Affected

217state residents only

Linked

9 filings

Confidence

65%

Full breach record for CALTON & ASSOCIATES, INC. →

Calton & Associates, Inc. notified Montana residents of a March 28, 2025 network intrusion where unauthorized individuals accessed personal data including names, SSNs, and account numbers. The company engaged the FBI, secured the network, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 90 days

Mar 28, 2025

Begins

Mar 28, 2025

Discovered

Jun 26, 2025

Filed

vs. sector median

5 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_d41208bd0df5c4562025-04-13 · +73dVerified by operator

Regulatory filings (7) · sorted by filing gap

Massachusetts State AGbd_304579978ce6e1e82025-06-26Verified by operator
Nebraska State AGbd_5573d40fb788057a2025-06-26Verified by operator
Washington State AGbd_6c8c5bac0f4c2f972025-06-26Verified by operator
California State AGbd_aeee1a1e6cfd8b062025-06-26Verified by operator

Show 3 more filings ↓up to 33d gap

Oregon State AGbd_d56e3cfbb0a0b9242025-06-30 · +4dVerified by operator
Illinois State AGbd_65c0b45d8c39dce52025-07-01 · +5dVerified
Massachusetts State AGbd_69979e8648007b882025-07-29 · +33dVerified by operator

Name: CALTON & ASSOCIATES, INC.
norm: calton associates
Domain: calton.com

Name: CALTON & ASSOCIATES, INC.
norm: calton associates
Domain: calton.com
Industry: Professional Servicesllm

Discovered: Mar 28, 2025
Breach occurred: Mar 28, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 26, 2025
Affected individuals: 217state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported the event to the FBI
Initial access: valid_credentials

During the incident: Took immediate steps to ensure the unauthorized individuals no longer had access to our network
Implemented additional cybersecurity measures
Reported the event to the FBI and is fully cooperating with their investigation
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Changes made: Implemented additional cybersecurity measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(90 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Massachusetts State AGJun 26 · first

Nebraska State AGJun 26 · first

Washington State AGJun 26 · first

California State AGJun 26 · first

Montana State AGJun 26 · first · this page

Oregon State AG+4d

Illinois State AG+5d

Massachusetts State AG+33d

Pattern: first filing Jun 26 (MA), last Jul 29 (MA) — a 33-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/06/Consumer-notification-letter-6.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 26, 2025
Raw hash: 4692574e3c240f0e8916fa553a3c4c81b6f15a8c242c52e79db130329ad7712a

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entityCALTON & ASSOCIATES, INC.

Victim entityCALTON & ASSOCIATES, INC.

Incidentdiscovered Mar 28, 2025

Stated responseTook immediate steps to ensure the unauthorized individuals no longer had access to our network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov