HackingFinancial ServicesFinanceCustomer Data InvolvedIdentity (basic)Government IDFinancial accountPCIMediumContained

IBW Financial Corporation

bd_2fd0d40bbe6a77b8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 30, 2021

Filed

Jan 9, 2023

To disclose

16 months

Affected

64state residents only

Linked

5 filings

Confidence

65%

Full breach record for IBW Financial Corporation →2 incidents on file

IBW Financial Corporation notified the NH AG of unauthorized access to an employee's computer on Sept 30, 2021. Investigation confirmed files were opened. 64 NH residents affected. Data included names, SSNs, driver's licenses, financial account, and payment card info. Notification sent Dec 23, 2022. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 months / 466 days

Sep 30, 2021

Begins

Sep 30, 2021

Discovered

Jan 9, 2023

Filed

vs. sector median

+58 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_5d2049a057f369a72022-12-23 · +17dCandidate
Maine State AGbd_61effadf787ddbcd2022-12-23 · +17dVerified
Massachusetts State AGbd_8e65aea96bc2f4f62022-12-23 · +17dVerified
Montana State AGbd_9832c31cd52561462022-12-23 · +17dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: IBW Financial Corporation
norm: ibw financial
Industry: Financial Servicesllm

Discovered: Sep 30, 2021
Breach occurred: Sep 30, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 23, 2022
Affected individuals: 64state-resident count only
Data types: Identity (basic)Government IDFinancial accountPCI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau

During the incident: Launched an investigation with the assistance of third-party computer specialists
Began a detailed review of the accessed files
Working to implement additional safeguards and training to its employees
Providing access to credit monitoring services for twenty-four months through Equifax
Changes made: Implement additional safeguards and training to its employees
Policies and procedures are being reviewed and enhanced where possible
Additional safeguards have been implemented
Additional workforce training is being conducted
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 months(466 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGDec 23 · first

Maine State AGDec 23 · first

Massachusetts State AGDec 23 · first

Montana State AGDec 23 · first

New Hampshire State AG+17d · this page

Pattern: first filing Dec 23 (CA), last Jan 9 (NH) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ibw-financial-corporation-20230109.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 9, 2023
Raw hash: 2643aafda4223b13fbe7fe86175a6ed7c9c5091b099300200e6c6f1de931df43

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityIBW Financial Corporation

Incidentdiscovered Sep 30, 2021

Stated responseLaunched an investigation with the assistance of third-party computer specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov