HackingFinancial ServicesFinanceSQL InjectionStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Government IDPIICriticalContained

Catholic United Financial

bd_163b0a2490838b83 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Sep 6, 2017

Filed

Oct 6, 2017

To disclose

4 weeks

Affected · nationwide

127,310495 in this filing

Linked

6 filings

Confidence

66%

Full breach record for Catholic United Financial →

Catholic United Financial notified members of a data breach involving SQL injection attacks on its web server. Unauthorized access occurred as of November 12, 2016, and was discovered on September 6, 2017. Approximately 127,310 members' personal information, including SSNs, was potentially accessed. The company engaged forensic investigators, notified the FBI and local sheriff, and provided two years of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 298 days

discovery → filing · 4 weeks / 30 days

Nov 12, 2016

Begins

Sep 6, 2017

Discovered

Oct 6, 2017

Filed

vs. sector median

5 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_095ea08906d84f192017-10-06Verified
Washington State AGbd_8e14bc01857077232017-10-06Verified by operator
New Hampshire State AGbd_444411c792158acf2017-10-05 · +1dVerified
Massachusetts State AGbd_d98cc38a86f2cabd2017-10-12 · +6dVerified

Show 1 more filing ↓up to 7d gap

Oregon State AGbd_a56592d36390de292017-10-13 · +7dVerified by operator

Name: Catholic United Financial
norm: catholic united financial

Name: Catholic United Financial
norm: catholic united financial
Industry: Financial Servicesllm

Discovered: Sep 6, 2017
Breach occurred: Nov 12, 2016
Undetected for: 298 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 17, 2017
Affected individuals: 127,310state + nationwide
Data types: Identity (basic)Government IDPII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the Ramsey County, Minnesota sheriffNotified the FBI
Initial access: exploit_public_facing

During the incident: Hired outside forensic investigators
Removed all potential access to personally identifiable information on its web server
Secured the web server from any possible further intrusion
Shut down its website
Notified the Ramsey County, Minnesota sheriff
Notified the FBI
Cooperating in their investigations
Changes made: Hardening its security with the help of outside experts
Restoring website with even-more enhanced security measures and programming
Secured the services of Kroll to provide identity monitoring at no cost for two years
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGOct 5 · first

California State AG+1d

Washington State AG+1d

Montana State AG+1d · this page

Massachusetts State AG+7d

Oregon State AG+8d

Pattern: first filing Oct 5 (NH), last Oct 13 (OR) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Catholic-United-Financial.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 6, 2017
Raw hash: dcd4e2b5102aced29436d2a228e8e1aad4129c12b75428ccab74adaca951ea56

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCatholic United Financial

Victim entityCatholic United Financial

Incidentdiscovered Sep 6, 2017

Stated responseHired outside forensic investigators

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov