HackingFinancial ServicesFinanceSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountHighActive

TRADEZERO AMERICA, INC.

bd_23d0e16efaa82b00 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 29, 2024

Filed

Sep 19, 2024

To disclose

7 weeks

Affected · nationwide

14,54245 in this filing

Linked

7 filings

Confidence

66%

Full breach record for TRADEZERO AMERICA, INC. →

TradeZero America Inc. reported a third-party vendor breach involving Tawk.To on July 29, 2024. Unauthorized access to customer communication files potentially exposed names, SSNs, driver's licenses, financial account info, and passport numbers. 14,542 individuals affected, including 45 Maine residents. TradeZero notified law enforcement, offered 12 months of credit monitoring, and is reviewing security policies.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jul 29, 2024 → Filed with AG Sep 19, 202452d ⏱ ME AG >30d7 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 7 weeks / 52 days

Jul 29, 2024

Begins

Jul 29, 2024

Discovered

Sep 19, 2024

Filed

vs. sector median

1 wks faster

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_5160a4280e3bad062024-09-19Verified
California State AGbd_62f236eaafb483552024-09-19Verified
Indiana State AGbd_a004f9015b01165b2024-09-19Verified
Montana State AGbd_c1b1002275e8fced2024-09-19Verified

Show 2 more filings ↓up to 18d gap

New Hampshire State AGbd_c66ea600f46a75802024-09-19Verified
Illinois State AGbd_e1115c7d2bc7f4462024-09-01 · +18dVerified

Name: TRADEZERO AMERICA, INC.
norm: tradezero america
Domain: tradezero.com
Industry: Financial Services

Name: TRADEZERO AMERICA, INC.
norm: tradezero america
Domain: tradezero.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Jul 29, 2024
Breach occurred: Jul 29, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 19, 2024
Affected individuals: 14,542state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified federal law enforcementProviding written notice to relevant state and federal regulatorsProviding notice to the three major credit reporting agencies
Third party: via Tawk.To
Initial access: supply_chain

During the incident: Launched an investigation to determine the nature and scope of the incident
Notified federal law enforcement regarding the event
Providing access to credit monitoring services for twelve (12) months, through TransUnion
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state and federal regulators
Providing written notice to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Reviewing policies procedures and processes related to the storage and access of personal information to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: ME AG >30d · 52d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jul 29, 2024
→ Filed with AG: Sep 19, 2024
52d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jul 29, 2024 → Filed with AG: Sep 19, 2024	52d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Illinois State AGSep 1 · first

Massachusetts State AG+18d

California State AG+18d

Indiana State AG+18d

Montana State AG+18d

New Hampshire State AG+18d

Maine State AG+18d · this page

Pattern: first filing Sep 1 (IL), last Sep 19 (ME) — a 18-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/dd67b3b5-a87d-429f-91b1-8976062f484d.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 19, 2024
Raw hash: 721be235eb4b883eb70f6bd82574be90282b1da4ff7ae22c3f3d3e4e5e90a74d

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityTRADEZERO AMERICA, INC.

Victim entityTRADEZERO AMERICA, INC.

Incidentdiscovered Jul 29, 2024

Stated responseLaunched an investigation to determine the nature and scope of the incident

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov