MalwareFinancial ServicesFinanceRansomwareData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountMediumActive

Nations Lending Corporation

bd_231a4080f001a679 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Sep 18, 2021

To disclose

—

Affected

152state residents only

Linked

9 filings

Confidence

66%

Nations Lending Corporation notified Montana residents of a ransomware attack on a third-party title company vendor in late July 2021. The attack encrypted vendor systems. Customer loan closing data, including names, SSNs, addresses, and financial info, may have been accessed. Nations Lending suspended vendor transactions, engaged Kroll for one year of identity monitoring, and mandated vendor security upgrades.

J jump to incidentP pin to compareR raw source

Incident timeline

Jul 1, 2021

Begins

Sep 18, 2021

Filed

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Montana State AGbd_386f622eba4dc4682021-10-11 · +23dVerified
California State AGbd_4a35f90413edc9552021-10-11 · +23dVerified
Indiana State AGbd_56bdf25981c92fa12021-10-11 · +23dVerified
New Hampshire State AGbd_5d2317244378f4942021-10-11 · +23dVerified

Show 4 more filings ↓up to 260d gap

Maine State AGbd_74da7c26092e16452021-10-11 · +23dVerified
Massachusetts State AGbd_80099a2e7a3661502021-10-11 · +23dVerified
South Carolina State AGbd_dcc132ba142622292021-10-11 · +23dVerified
Illinois State AGbd_1a19b7b2bb1140b72021-01-01 · +260dCandidate

Name: Timios Inc.
norm: timios

Name: Nations Lending Corporation
norm: nations lending
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Jul 1, 2021 – Jul 31, 2021
Materiality determined: —
Notification sent: —
Affected individuals: 152state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Initial access: supply_chain

During the incident: Suspended any further transactions with the vendor
Moved pending closings to our other service providers
Secured the services of Kroll to provide identity monitoring at no cost to you for one year
Changes made: Vendor is reviewing their security practices and controls and upgrading their security systems
Vendor will have to pass a complete cybersecurity evaluation before resuming business transactions
Vendor must demonstrate that their systems and personnel are hardened against any further attacks
Requiring review of their data storage policies to minimize how long your information remains in their systems
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 8 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+260d · this page

Montana State AG+283d

California State AG+283d

Indiana State AG+283d

New Hampshire State AG+283d

Maine State AG+283d

Massachusetts State AG+283d

South Carolina State AG+283d

Pattern: first filing Jan 1 (IL), last Oct 11 (SC) — a 283-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-13.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 18, 2021
Raw hash: 028ffc230f774f248b28df814c5c2a268d7e0808ea8119c039f9eceaf3717549

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityTimios Inc.

Victim entityNations Lending Corporation

IncidentRansomware

Stated responseSuspended any further transactions with the vendor

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov