HackingFinancial ServicesTechnologyFinanceStolen CredentialsCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Government IDFinancial accountMediumContained

APEX CLEARING CORPORATION

bd_3347d5f9f86d252c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 1, 2022

Filed

Dec 22, 2022

To disclose

21 days

Affected

18state residents only

Linked

6 filings

Confidence

66%

Full breach record for APEX CLEARING CORPORATION →

Apex Clearing Corporation notified the NH AG of a security incident where unauthorized individuals used stolen Monorail Securities credentials to access Apex systems between March and October 2022. Personal info of 18 NH residents, including SSN last 4 digits, bank account numbers, and names, was exposed. Apex reset credentials, engaged forensic investigators, notified law enforcement and FINRA, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 275 days

discovery → filing · 21 days

Mar 1, 2022

Begins

Dec 1, 2022

Discovered

Dec 22, 2022

Filed

vs. sector median

6 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_0def4f0d4ad56cf82022-12-22Verified
Montana State AGbd_3a9057f3d2bde8772022-12-22Verified by operator
Massachusetts State AGbd_88ecc72114f7395b2022-12-22Verified
Maine State AGbd_ecf20a22bfccfed92022-12-22Verified by operator

Show 1 more filing ↓up to 1d gap

Maine State AGbd_337dd6181775ad842022-12-21 · +1dCandidate

Name: APEX CLEARING CORPORATION
norm: apex clearing
Domain: apexfintechsolutions.com

Name: APEX CLEARING CORPORATION
norm: apex clearing
Domain: apexfintechsolutions.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Dec 1, 2022
Breach occurred: Mar 1, 2022 – Oct 1, 2022
Undetected for: 275 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 22, 2022
Affected individuals: 18state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Made a report to FINRANotified law enforcement
Initial access: valid_credentials

During the incident: Engaged a leading forensic investigator to help determine the extent of access and exposure
Reset Monorail’s credentials
Implemented additional safeguards to protect Apex’s systems
Sent notification letters to the affected New Hampshire residents
Offered complimentary credit monitoring and identity protection services through Kroll to certain affected individuals for 12 months
Made a report to FINRA
Notified law enforcement
Changes made: Implemented additional safeguards to protect Apex’s systems
Enhanced its data security measures to prevent the occurrence of a similar event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Maine State AGDec 21 · first

Indiana State AG+1d

Montana State AG+1d

Massachusetts State AG+1d

Maine State AG+1d

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/apex-clearing-20221222.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 22, 2022
Raw hash: dbd88fc693be0d044a6bb0f7ad64adcabb3973960d97dd98ca212f8baaacd7a4

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAPEX CLEARING CORPORATION

Victim entityAPEX CLEARING CORPORATION

Incidentdiscovered Dec 1, 2022

Stated responseEngaged a leading forensic investigator to help determine the extent of access and exposure

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov