MalwareFinancial ServicesTechnologyFinanceRansomwareData EncryptedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PIIHighContained

Welfare & Pension Administration Service

bd_3310fc3e52959a1b · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 21, 2021

Filed

Feb 18, 2022

To disclose

30 weeks

Affected

1,209state residents only

Linked

9 filings

Confidence

64%

Full breach record for Welfare & Pension Administration Service →2 incidents on file

WPAS discovered malware encrypting systems on July 21, 2021. Investigation confirmed unauthorized access to folders. Potentially affected data includes names, SSNs, driver's licenses, financial accounts, and health information. WPAS engaged forensic specialists, reset passwords, and notified law enforcement. Notification letters were sent starting December 20, 2021.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 30 weeks / 212 days

Jul 21, 2021

Discovered

Feb 18, 2022

Filed

vs. sector median

+22 wks slower

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Washington State AGbd_3c90155397c03f172022-02-18Verified
Oregon State AGbd_66e850c7b658631f2022-02-18Verified
Massachusetts State AGbd_81fb850493c1f6d92022-02-18Verified
Indiana State AGbd_8d885d53f1427d3f2022-02-18Verified

Show 4 more filings ↓up to 109d gap

Maine State AGbd_a919a5f469090b542022-02-18Verified
Illinois State AGbd_94ac72ab0a95622d2022-01-01 · +48dVerified by operator
Maine State AGbd_40afb8ad7dca4af52022-06-07 · +109dVerified
Maine State AGbd_f1d21f60cb700f432022-06-07 · +109dVerified

Name: Welfare & Pension Administration Service
norm: welfare pension administration service
Domain: wpas-inc.com

Name: Welfare & Pension Administration Service
norm: welfare pension administration service
Domain: wpas-inc.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Jul 21, 2021
Materiality determined: —
Notification sent: Dec 20, 2021
Affected individuals: 1,209state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PII
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcementNotifying relevant regulatory authorities as required

During the incident: Activated its Incident Response Team
Isolated the affected systems
Initiated other containment measures
Engaged third-party forensic specialists to assist with the investigation
Reset passwords across the network
Notified federal law enforcement regarding this event
Changes made: Reviewing and enhancing existing policies and procedures
Implementing additional safeguards to further secure the information in our systems
Offering twelve (12) months of identity monitoring services through Kroll at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(212 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 7 states

View merged incident ↗

Illinois State AGJan 1 · first

Washington State AG+48d

Oregon State AG+48d

Massachusetts State AG+48d

Indiana State AG+48d

Maine State AG+48d

Montana State AG+48d · this page

Maine State AG+157d

Pattern: first filing Jan 1 (IL), last Jun 7 (ME) — a 157-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-230.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 18, 2022
Raw hash: 2263d18180230c89008fe97af9080212141ff4feb3b7c49229e4d8a25a1d70f1

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityWelfare & Pension Administration Service

Victim entityWelfare & Pension Administration Service

Incidentdiscovered Jul 21, 2021

Stated responseActivated its Incident Response Team

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov