HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)LowContained

KOHLER CREDIT UNION

bd_1e6f37e90209ef2e · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 30, 2020

Filed

Mar 25, 2021

To disclose

16 weeks

Affected

6state residents only

Linked

3 filings

Confidence

66%

Full breach record for KOHLER CREDIT UNION →

Kohler Credit Union notified affected individuals that an unauthorized third party gained access to two employee email accounts containing personal information between September 23 and November 30, 2020. The credit union secured the accounts, engaged forensic investigators, and offered one year of Experian IdentityWorks. No fraud was detected.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 68 days

discovery → filing · 16 weeks / 115 days

Sep 23, 2020

Begins

Nov 30, 2020

Discovered

Mar 25, 2021

Filed

vs. sector median

+8 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_02eecfc3839c71a62021-03-25Candidate
Massachusetts State AGbd_e214d615de62f86b2021-03-26 · +1dVerified

Name: KOHLER CREDIT UNION
norm: kohler credit union

Name: KOHLER CREDIT UNION
norm: kohler credit union
Industry: Financial Servicesllm

Discovered: Nov 30, 2020
Breach occurred: Sep 23, 2020 – Nov 30, 2020
Undetected for: 68 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 6state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the email accounts to prevent any further access
Engaged a forensic security firm to investigate and confirm the security of our email and computer systems
Changes made: Enhancing our technical security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(115 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGMar 25 · first

Montana State AGMar 25 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Kohler-Notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 25, 2021
Raw hash: a878ef881e7865b113d893cc423af566905e9923771c8ebf58d8d404dbc2f106

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityKOHLER CREDIT UNION

Victim entityKOHLER CREDIT UNION

Incidentdiscovered Nov 30, 2020

Stated responseSecured the email accounts to prevent any further access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov