HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

Pendrick Capital Partner Holdings, LLC

bd_20f8d12fcada7d80 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 14, 2021

Filed

Aug 23, 2021

To disclose

14 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

64%

Full breach record for Pendrick Capital Partner Holdings, LLC →

Pendrick Capital Partner Holdings, LLC disclosed unauthorized access to employee email accounts between April 12, 2021, and May 14, 2021. The company discovered suspicious activity on May 14, 2021. The incident potentially exposed names, Social Security numbers, and financial account information of customers. Pendrick engaged third-party forensic investigators, secured the accounts, and is offering credit monitoring services. No evidence of actual misuse was found.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 14, 2021 → Notified Aug 20, 202198d ✗ CA 60-day late14 weeks discovery → filing

Incident timeline

undetected · 32 days

discovery → filing · 14 weeks / 101 days

Apr 12, 2021

Begins

May 14, 2021

Discovered

Aug 23, 2021

Filed

vs. sector median

+5 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_251768df5aee988c2021-08-23Verified
Massachusetts State AGbd_26ac748ef86276b52021-08-23Verified
Montana State AGbd_bc01fb206a779df42021-08-23Verified
Indiana State AGbd_e26c81812e7c71682021-08-23Verified

Show 1 more filing ↓up to 7d gap

New Hampshire State AGbd_861ad204f291528c2021-08-30 · +7dVerified

Name: Pendrick Capital Partner Holdings, LLC
norm: pendrick capital partner
Domain: pendrickcp.com

Name: Pendrick Capital Partner Holdings, LLC
norm: pendrick capital partner
Domain: pendrickcp.com
Industry: Financial Servicesllm

Discovered: May 14, 2021
Breach occurred: Apr 12, 2021 – May 14, 2021
Undetected for: 32 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 20, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified regulatory authorities, as required by law
Initial access: valid_credentials

During the incident: Took steps to secure the account
Launched an investigation to determine the nature and scope of the incident
Launched an in-depth investigation with the assistance of third-party forensic investigators
Notified regulatory authorities, as required by law
Individually notifying the potentially affected individuals
Changes made: Reviewed its existing policies and procedures relating to data protection and security
Investigating additional security measures to mitigate any risk associated with this incident
Implemented additional safeguards to further secure the information in its systems
Providing individuals with access to complimentary credit monitoring and identity protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(101 days from discovery to filing)
Compliance flags: CA 60-day late · 98d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 14, 2021
→ Notified: Aug 20, 2021
98d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 14, 2021 → Notified: Aug 20, 2021	98d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGAug 23 · first

Massachusetts State AGAug 23 · first

Montana State AGAug 23 · first

Indiana State AGAug 23 · first

California State AGAug 23 · first · this page

New Hampshire State AG+7d

Pattern: first filing Aug 23 (ME), last Aug 30 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-544183
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 23, 2021
Raw hash: b2da3c65b9c4c9b746ff6c58eaccbf6ddffed95194bf763fb51fdddd2d8ff998

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityPendrick Capital Partner Holdings, LLC

Victim entityPendrick Capital Partner Holdings, LLC

Incidentdiscovered May 14, 2021

Stated responseTook steps to secure the account

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov