HackingFinancial ServicesEducationFinanceSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

AccessLex Institute

bd_30bbc40e8991bdb4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Oct 8, 2024

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

76%

Full breach record for AccessLex Institute →3 incidents on file

AccessLex Institute (d/b/a Access Group) notified affected individuals of a third-party breach at vendor Financial Business and Consumer Solutions, Inc. (FBCS). FBCS discovered unauthorized access to its network on February 26, 2024. Potentially compromised data includes name, address, SSN, date of birth, phone number, and financial account numbers. Access Group's own systems were not compromised. Epiq provided credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 26, 2024

Begins

Oct 8, 2024

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_587cac05b083faad2024-10-08Verified
Indiana State AGbd_b133e6efb8f9b3552024-08-14 · +55dCandidate

Name: AccessLex Institute
norm: accesslex institute

Name: AccessLex Institute
norm: accesslex institute
Industry: Financial ServicesllmEducationllm

Discovered: —
Breach occurred: Feb 26, 2024
Materiality determined: —
Notification sent: Jul 16, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Third party: via Financial Business and Consumer Solutions, Inc. (FBCS)
Initial access: supply_chain

During the incident: Promptly began taking steps to ensure Access Group borrowers are properly notified
Providing access to credit monitoring and fraud assistance services at no charge through Epiq
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGAug 14 · first

Montana State AG+55d

California State AG+55d · this page

Pattern: first filing Aug 14 (IN), last Oct 8 (CA) — a 55-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-593097
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 8, 2024
Raw hash: d2c09cd65ae80c2846b1836ff40955678d01aa1e9e85dec39eed2e4abf9f006e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAccessLex Institute

Victim entityAccessLex Institute

IncidentThird-Party / Supply Chain

Stated responsePromptly began taking steps to ensure Access Group borrowers are properly notified

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov