HackingOtherCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

CBC Group, Inc.

bd_383944445d1536d2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 23, 2022

Filed

Sep 2, 2022

To disclose

10 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for CBC Group, Inc. →

CBC Group, Inc. notified Montana residents of a cybersecurity attack discovered on June 23, 2022. An unknown actor gained unauthorized access to the network, potentially exposing names, SSNs, driver's licenses, financial account numbers, and passport numbers. CBC engaged forensic experts, notified the FBI, and offered 12 months of credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 71 days

Jun 23, 2022

Discovered

Sep 2, 2022

Filed

vs. sector median

+2 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_3f3a03c7bb1602a32022-09-02Verified
Massachusetts State AGbd_db68bf08a7b831d22022-09-02Verified

Name: CBC Group, Inc.
norm: cbc group

Name: CBC Group, Inc.
norm: cbc group
Industry: Otherllm

Discovered: Jun 23, 2022
Materiality determined: —
Notification sent: Aug 16, 2022
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the matter to the Federal Bureau of Investigation

During the incident: Engaged cybersecurity experts to assist with an investigation
Reported the matter to the Federal Bureau of Investigation
Offering 12 months of complimentary credit monitoring and identity protection services through Kroll
Changes made: Took steps to enhance its security to help minimize the likelihood that an event like this could occur again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(71 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGSep 2 · first

Massachusetts State AGSep 2 · first

Montana State AGSep 2 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-541.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 2, 2022
Raw hash: b5cdb896624ebc2246ff04a2af28d24f9c1102069696ae70f14b44da6235d898

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCBC Group, Inc.

Victim entityCBC Group, Inc.

Incidentdiscovered Jun 23, 2022

Stated responseEngaged cybersecurity experts to assist with an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov