HackingFinancial ServicesTechnologyFinanceVulnerability ExploitCapture Stored DataData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedTargetedPIIIdentity (basic)LowContained

Pear Tree Advisors, Inc

bd_3c94b5526a69175f · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 5, 2023

Filed

Jul 10, 2023

To disclose

5 weeks

Affected

100state residents only

Linked

6 filings

Confidence

65%

Full breach record for Pear Tree Advisors, Inc →

Pear Tree Advisors, Inc. reported a data security incident involving its third-party vendor, Integrated Systems Corporation (ISCorp). Unauthorized individuals exploited a vulnerability in MOVEit file transfer software on May 31, 2023, accessing shareholder data queued for transfer. The incident affected 100 New Hampshire residents. PTA engaged forensic investigators and IT providers, and offered credit monitoring services to affected shareholders.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 5 weeks / 35 days

May 31, 2023

Begins

Jun 5, 2023

Discovered

Jun 14, 2023

Scope determined

Jul 10, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_2355ed4a6f65a21c2023-07-07 · +3dCandidate
California State AGbd_367e14f9a58bed932023-07-07 · +3dVerified
Maine State AGbd_b166807b6cfdfe132023-07-07 · +3dVerified
Indiana State AGbd_b207bf9502b3a8d22023-07-07 · +3dVerified

Show 1 more filing ↓up to 3d gap

Massachusetts State AGbd_c7afa2abf78bc4582023-07-07 · +3dVerified

Name: Pear Tree Advisors, Inc
norm: pear tree advisors

Name: Pear Tree Advisors, Inc
norm: pear tree advisors
Industry: Financial ServicesllmTechnologyllm

Discovered: Jun 5, 2023
Breach occurred: May 31, 2023
Undetected for: 5 daysoccurrence → discovery
Materiality determined: Jun 14, 2023
Notification sent: Jul 7, 2023
Affected individuals: 100state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Department of Justice Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Engaged third-party IT provider for support in assessing and responding to the incident
Hired a leading computer forensic firm to assist
Offering affected shareholders complimentary membership in Experian IdentityWorks identity theft protection services
Changes made: Implementing additional data protection measures recommended by Envision
Instituted new shareholder-verification procedures
Enhancing data security practices with respect to data held within ISCorp’s private cloud environment
Implementing additional technical safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGJul 7 · first

California State AGJul 7 · first

Maine State AGJul 7 · first

Indiana State AGJul 7 · first

Massachusetts State AGJul 7 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/pear-tree-advisors-20230710.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 10, 2023
Raw hash: f8a7ca8121c2d4544d3d3e9d9000d5c69524f71f5ebb600119ebcfb6c85f05bd

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityPear Tree Advisors, Inc

Victim entityPear Tree Advisors, Inc

Incidentdiscovered Jun 5, 2023

Stated responseEngaged third-party IT provider for support in assessing and responding to the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov