DisclosureLens
HackingFinancial ServicesFinanceCustomer Data InvolvedSupply Chain (3P Vendor)Financial accountFinancial credentialsMediumContained

JOHNSON FINANCIAL GROUP, INC.

bd_33cf28f8c7a4bdc9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 25, 2023

Filed

Sep 22, 2023

To disclose

8 weeks

Affected · nationwide

93,09321 in this filing

Linked

2 filings

Confidence

50%
Full breach record for JOHNSON FINANCIAL GROUP, INC.2 incidents on file

Johnson Financial Group, a financial services company, reported a data breach impacting 21 Maine residents. The breach, which occurred on May 27, 2023, was discovered on July 25, 2023. The incident was categorized as an external system breach or hacking, and it resulted in the compromise of financial account numbers or credit/debit card numbers, along with their corresponding security codes or PINs. The notification to affected consumers was sent on September 22, 2023. In response, the company has offered 24 months of credit monitoring and identity theft restoration services. The breach notification was submitted by outside counsel for Fidelity National Information Services, Inc., suggesting a third-party vendor was involved in the incident.

Maine clockDiscovered Jul 25, 2023Filed with AG Sep 22, 202359d ME AG >30d8 weeks discovery → filing
AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 59 days
discovery → filing · 8 weeks / 59 days

May 27, 2023

Begins

Jul 25, 2023

Discovered

Sep 22, 2023

Filed

vs. sector median

on median

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Filing propagation · 2 filings · 2 states

View merged incident ↗
Montana State AGSep 21 · first
Maine State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.