HackingFinancial ServicesFinanceStolen CredentialsTargetedIdentity (basic)Government IDFinancial accountEmploymentMediumContained

CNU Online Holdings, LLC

bd_38cb8cacb5c0c814 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 20, 2018

Filed

Mar 13, 2018

To disclose

21 days

Affected

3state residents only

Linked

5 filings

Confidence

67%

Full breach record for CNU Online Holdings, LLC →6 incidents on file

CNU Online Holdings, LLC d/b/a NetCredit notified the NH AG of a security incident discovered on Feb 20, 2018. An unauthorized party used valid credentials to access a small percentage of accounts, potentially viewing PII, SSN, and bank info. 3 NH residents affected. Notifications sent March 8, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 days

Feb 20, 2018

Discovered

Mar 13, 2018

Filed

vs. sector median

6 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_973201a05a5f0eec2018-03-14 · +1dVerified
Montana State AGbd_6e2f05cd61fffc602018-03-08 · +5dCandidate
California State AGbd_d512eb1b597f5b6b2018-03-19 · +6dVerified
Massachusetts State AGbd_5ac2e0f62a2e7c212018-04-23 · +41dCandidate

Name: CNU Online Holdings, LLC
norm: cnu online

Name: CNU Online Holdings, LLC
norm: cnu online
Industry: Financial Servicesllm

Discovered: Feb 20, 2018
Materiality determined: —
Notification sent: Mar 8, 2018
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial accountEmployment
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: valid_credentials

During the incident: Restricted access to the online accounts that it believes were affected by disabling the current passwords and requiring account holders to reset their passwords
Disabled the ability to change an account holder's email address and bank account information through the online account
Requiring account holders to call NetCredit directly and provide specific proof of identity before any changes to the email addresses or bank account information on an account can be made
Continuing to monitor these accounts for suspicious activity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Montana State AGMar 8 · first

New Hampshire State AG+5d · this page

Massachusetts State AG+6d

California State AG+11d

Massachusetts State AG+46d

Pattern: first filing Mar 8 (MT), last Apr 23 (MA) — a 46-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cnu-20180313.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 13, 2018
Raw hash: b5d31b8df4d9e2d81e3275919f2fa15e310b475029513b3f77c0fb8b70d29d90

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCNU Online Holdings, LLC

Victim entityCNU Online Holdings, LLC

Incidentdiscovered Feb 20, 2018

Stated responseRestricted access to the online accounts that it believes were affected by disabling the current passwords and requiring account holders to reset their passwords

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov