Social EngineeringFinancial ServicesTechnologyFinancePhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)PIILowContained

CX Institutional, LLC

bd_1c2d0d557f440d8d · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 6, 2025

Filed

Nov 21, 2025

To disclose

15 weeks

Affected

9state residents only

Linked

2 filings

Confidence

67%

Full breach record for CX Institutional, LLC →

CX Institutional, LLC notified Montana residents of a data security incident discovered on August 6, 2025. An unknown actor accessed an email account via suspicious activity, potentially exposing names, addresses, and other personal information. The company engaged cybersecurity specialists and is offering complimentary credit monitoring through Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 15 weeks / 107 days

Aug 6, 2025

Discovered

Nov 21, 2025

Filed

vs. sector median

+7 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_1011faf90be0a3322025-11-22 · +1dVerified

Name: CX Institutional, LLC
norm: cx institutional

Name: CX Institutional, LLC
norm: cx institutional
Industry: Financial ServicesllmTechnologyllm

Discovered: Aug 6, 2025
Materiality determined: —
Notification sent: —
Affected individuals: 9state-resident count only
Data types: Identity (basic)PII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Engaged cybersecurity specialists to conduct a thorough review
Offering complimentary credit monitoring and identity theft protection services through Kroll
Changes made: Implemented several measures to enhance security posture
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(107 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGNov 21 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2026/01/Consumer-notification-letter-13.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 21, 2025
Raw hash: d0dcd1d819196ccdb6de8d49dfbafe09beeda7218205dad018ec4a0f738af180

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCX Institutional, LLC

Victim entityCX Institutional, LLC

Incidentdiscovered Aug 6, 2025

Stated responseEngaged cybersecurity specialists to conduct a thorough review

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov