HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Newbridge Securities Corporation

bd_17038b233b71647e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 30, 2021

Filed

Oct 14, 2021

To disclose

6 weeks

Affected

58state residents only

Linked

6 filings

Confidence

65%

Full breach record for Newbridge Securities Corporation →2 incidents on file

Newbridge Securities Corporation notified Montana residents of a network intrusion occurring between Feb 24 and Mar 18, 2021. The company determined on Aug 30, 2021 that customer PII, including SSNs and account info, may have been accessed. Remediation included MFA implementation and enhanced logging. Experian IdentityWorks was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 187 days

discovery → filing · 6 weeks / 45 days

Feb 24, 2021

Begins

Aug 30, 2021

Discovered

Oct 14, 2021

Filed

vs. sector median

2 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_29d0e1f53c68f5cf2021-10-14Verified
Maine State AGbd_8b3162b529c149d32021-10-14Verified by operator
California State AGbd_d2ca3d9293e68dfe2021-10-14Verified
New Hampshire State AGbd_ef2137acf08ba54a2021-10-14Verified

Show 1 more filing ↓up to 1d gap

Indiana State AGbd_5f354b0086510be12021-10-13 · +1dVerified

Name: Newbridge Securities Corporation
norm: newbridge securities

Name: Newbridge Securities Corporation
norm: newbridge securities
Industry: Financial Servicesllm

Discovered: Aug 30, 2021
Breach occurred: Feb 24, 2021 – Mar 18, 2021
Undetected for: 187 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 58state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Took immediate steps to secure the network
Began an investigation
Engaged a cybersecurity firm to assist
Conducted a thorough review of potentially accessed information
Offering a complimentary one-year membership of Experian IdentityWorks
Changes made: Removing legacy authentication methods
Increasing audit logging on all systems
Applying hardening policies for greater encryption on system communication
Increasing the sensitivity of endpoint protection tools
Strengthening password policies to require greater complexity
Implementing multifactor authentication for both internal and remote network access
Strengthening email security efforts for identifying phishing emails or malicious content
Internal training for our users to identify these types of events
Created a dedicated call center to answer any questions
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGOct 13 · first

Massachusetts State AG+1d

Maine State AG+1d

California State AG+1d

New Hampshire State AG+1d

Montana State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-7.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 14, 2021
Raw hash: 93b99d37763949fcb7f21149abd684234aceb8b3e497144021c55db217dccffd

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityNewbridge Securities Corporation

Victim entityNewbridge Securities Corporation

Incidentdiscovered Aug 30, 2021

Stated responseTook immediate steps to secure the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov