MalwareRansomwareSupply Chain (3P Vendor)Data EncryptedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Nations Lending Corporation
bd_3e3daf05fdd14004 · schema v1 · pii pii-v1
Full breach record for Nations Lending Corporation →Nations Lending Corporation notified customers that a third-party title company vendor suffered a ransomware attack in late July 2021. The attack encrypted the vendor's systems. Nations Lending determined that customer data, including names, addresses, Social Security numbers, and financial account information, may have been accessed. Nations Lending suspended transactions with the vendor, moved pending closings to other providers, and offered one year of identity monitoring via Kroll.
California clockDiscovered Aug 15, 2021 → Notified Aug 15, 20210d ✓ CA 60-day OK26 days discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_df6458561cded404Maine State AGfiled 2021-09-19(9d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-545175
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 10, 2021
- Raw hash
- 096d76ff6eab5dd71547d0c6621722c2f63eaa94ac75b59fad90fc1a1cd2e6f0
Reporting entity
- Name
- Nations Lending Corporationnorm: nations lending
Victim entity
- Name
- Nations Lending Corporationnorm: nations lending
Incident
- Discovered
- Aug 15, 2021
- Materiality determined
- —
- Notification sent
- Aug 15, 2021
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Third party
- via Title company vendor
- Initial access
- supply_chain
Compliance
- Time to disclose
- 26 days(26 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 0d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Aug 15, 2021→ Notified: Aug 15, 20210d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.