Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsTargetedCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountMediumContained

COR Clearing LLC (COR)

bd_3c1402609f88a0d3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 7, 2018

Filed

Dec 11, 2018

To disclose

14 weeks

Affected

1state residents only

Linked

2 filings

Confidence

67%

Full breach record for COR Clearing LLC (COR) →

COR Clearing LLC reported a security incident to the New Hampshire Attorney General on December 11, 2018. On September 7, 2018, the company discovered unauthorized access to employee email accounts after a bad actor used an employee's credentials to send phishing emails. The investigation identified one New Hampshire resident whose personal information (SSN, Driver's License, financial account info) was in an email attachment. No evidence of actual data access was found, but notifications were sent out of caution. The FBI, FINRA, and NY DFS were notified. The company engaged forensic investigators and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 95 days

Sep 7, 2018

Discovered

Dec 11, 2018

Filed

vs. sector median

+5 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_811aad3fb0c4d0792018-12-12 · +1dVerified

Name: COR Clearing LLC (COR)
norm: cor clearing llc cor
Domain: corclearing.com
Industry: financial_services

Name: COR Clearing LLC (COR)
norm: cor clearing llc cor
Domain: corclearing.com
Industry: financial_services
Industry: Financial Servicesllm

Discovered: Sep 7, 2018
Materiality determined: —
Notification sent: Dec 12, 2018
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)Financial account
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Reported the incident to the FBI's Internet Crime Complaint CenterReported the incident to the Financial Industry Regulatory Authority, Inc. (FINRA)Reported the incident to the New York Department of Financial Services
Initial access: phishing_link

During the incident: Engaged a cybersecurity firm to investigate the incident and conduct a forensic assessment of the incident
Reported the incident to the FBI's Internet Crime Complaint Center
Reported the incident to the Financial Industry Regulatory Authority, Inc. (FINRA)
Reported the incident to the New York Department of Financial Services
Changes made: Implemented additional technical safeguards
Improved procedures to increase the security of email accounts
Reviewing internal policies to make sure employees are more aware and vigilant of fraudulent email campaigns
Encouraging employees to report any suspicious activity
Offering complimentary two-year membership in Experian's IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(95 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGDec 11 · first · this page

Montana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cor-clearing-20181211.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 11, 2018
Raw hash: 1734f4989c1b08038765dd4f7384e293a29a1220f1e6ca037eeeed5e9f53b582

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCOR Clearing LLC (COR)

Victim entityCOR Clearing LLC (COR)

Incidentdiscovered Sep 7, 2018

Stated responseEngaged a cybersecurity firm to investigate the incident and conduct a forensic assessment of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov