MalwareFinancial ServicesFinanceRansomwareData ExfiltratedRansom DemandedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

CNA FINANCIAL CORPORATION

bd_2498cf3d61584cfe · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 21, 2021

Filed

Jul 8, 2021

To disclose

16 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

64%

Full breach record for CNA FINANCIAL CORPORATION →

CNA Financial Corporation suffered a sophisticated ransomware attack. The threat actor accessed systems from March 5 to March 21, 2021, copying a limited amount of data before deploying ransomware. CNA discovered the incident on March 21, 2021. Affected data included names and Social Security numbers. CNA engaged cybersecurity firms, notified the FBI, and implemented security enhancements. Complimentary identity monitoring was offered to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 21, 2021 → Notified Jul 9, 2021110d ✗ CA 60-day late16 weeks discovery → filing

Incident timeline

undetected · 16 days

discovery → filing · 16 weeks / 109 days

Mar 5, 2021

Begins

Mar 21, 2021

Discovered

Jul 8, 2021

Filed

vs. sector median

+7 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Massachusetts State AGbd_53180e7c81f57e152021-07-08Verified
HHS OCRbd_641fa664e7fa983f2021-07-08Verified
Maine State AGbd_7abcb947b9a916802021-07-08Verified
Washington State AGbd_7f8a3a5d1d0c1ff62021-07-08Verified

Show 4 more filings ↓up to 4d gap

Montana State AGbd_107e3f0f52c95ee92021-07-09 · +1dVerified
Oregon State AGbd_8f8adf6678098d272021-07-09 · +1dVerified
Indiana State AGbd_eb7c4eb9cabf7a572021-07-09 · +1dVerified
New Hampshire State AGbd_bdd258432c11e6292021-07-12 · +4dVerified

Name: CNA FINANCIAL CORPORATION
norm: cna financial
Domain: cna.com

Name: CNA FINANCIAL CORPORATION
norm: cna financial
Domain: cna.com
Industry: Financial Servicesllm

Discovered: Mar 21, 2021
Breach occurred: Mar 5, 2021 – Mar 21, 2021
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 9, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported the incident to the FBI

During the incident: Retained leading cybersecurity firms to assist in responding and help conduct a thorough investigation of the incident
Reported the incident to, and is working closely with, the appropriate law enforcement authorities, including the FBI
Changes made: Implemented numerous additional measures designed to enhance the security of our network, systems, and data
Offering a complimentary 24 month membership of Experian’s IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(109 days from discovery to filing)
Compliance flags: CA 60-day late · 110d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 21, 2021
→ Notified: Jul 9, 2021
110d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 21, 2021 → Notified: Jul 9, 2021	110d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Massachusetts State AGJul 8 · first

HHS OCRJul 8 · first

Maine State AGJul 8 · first

Washington State AGJul 8 · first

California State AGJul 8 · first · this page

Montana State AG+1d

Oregon State AG+1d

Indiana State AG+1d

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-542696
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 8, 2021
Raw hash: baf5f008ed591c001fe2bafe87962ab80d9be0dc99023edb24bea38e38328a17

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityCNA FINANCIAL CORPORATION

Victim entityCNA FINANCIAL CORPORATION

Incidentdiscovered Mar 21, 2021

Stated responseRetained leading cybersecurity firms to assist in responding and help conduct a thorough investigation of the incident

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov