AccidentalFinancial ServicesFinanceMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumResolved

Aspire Financial Services, LLC

bd_2cd6c30b631a3156 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 10, 2019

Filed

Feb 8, 2019

To disclose

29 days

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Aspire Financial Services, LLC →3 incidents on file

Aspire Financial Services, LLC disclosed a data incident where a misconfiguration in its recordkeeping system caused advisor-generated reports to inadvertently include personal and financial information of plan participants who were not clients of those advisors. The issue occurred between December 5, 2018, and January 17, 2019. Aspire resolved the issue, removed access to the reports, and notified affected advisors to destroy the data. No specific count of affected individuals was provided in this notification.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 36 days

discovery → filing · 29 days

Dec 5, 2018

Begins

Jan 10, 2019

Discovered

Feb 8, 2019

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_9052880e376047a72019-02-11 · +3dVerified

Name: Aspire Financial Services, LLC
norm: aspire financial
Domain: aspireonline.com

Name: Aspire Financial Services, LLC
norm: aspire financial
Domain: aspireonline.com
Industry: Financial Servicesllm

Discovered: Jan 10, 2019
Breach occurred: Dec 5, 2018 – Jan 17, 2019
Undetected for: 36 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection

During the incident: Resolved the issue with the advisor reports
Removed any previously generated reports from advisors’ access
Notified the advisors who had generated the impacted reports
Instructed advisors not to use any of the unauthorized information
Instructed advisors to destroy any copies of the unauthorized information
Changes made: Implemented controls to prevent unauthorized report generation
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGFeb 8 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Aspire-Consumer-Breach-Notification.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 8, 2019
Raw hash: 48a413a648f2bf9cc9a0837f3b465d2bc4f1321dadd200a725f2eee684976340

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAspire Financial Services, LLC

Victim entityAspire Financial Services, LLC

Incidentdiscovered Jan 10, 2019

Stated responseResolved the issue with the advisor reports

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov