HackingFinancial ServicesTechnologyFinanceVulnerability ExploitZero-DayTargetedIdentity (basic)Government IDFinancialMediumContained

First Analysis Corporation

bd_4036dbfb4c885f11 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 9, 2024

Filed

Nov 14, 2024

To disclose

14 weeks

Affected

2state residents only

Linked

3 filings

Confidence

65%

Full breach record for First Analysis Corporation →

First Analysis Corp. disclosed a data breach occurring between August 7-9, 2024, caused by exploitation of a zero-day vulnerability in a security device. Unauthorized access impacted names, addresses, emails, financial info, and SSNs. The company engaged forensic experts and offers 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 14 weeks / 97 days

Aug 7, 2024

Begins

Aug 9, 2024

Discovered

Nov 14, 2024

Filed

vs. sector median

+5 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_c3c9ff046eb559a72024-11-14Verified
Massachusetts State AGbd_17668f8ae51ee1682024-11-19 · +5dVerified

Name: First Analysis Corporation
norm: first analysis

Name: First Analysis Corporation
norm: first analysis
Industry: Financial ServicesllmTechnologyllm

Discovered: Aug 9, 2024
Breach occurred: Aug 7, 2024 – Aug 9, 2024
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Took a series of steps to contain the incident
Remediate the issue
Launched an investigation of the incident
Working with outside forensics and cybersecurity experts
Offering 24 months of identity protection services and credit monitoring from a leading identity monitoring services company, Epiq, at no charge
Changes made: Remediate the issue
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(97 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGNov 14 · first

Montana State AGNov 14 · first · this page

Massachusetts State AG+5d

Pattern: first filing Nov 14 (IN), last Nov 19 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/01/Consumer-notification-letter-16.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 14, 2024
Raw hash: 39f89e7e69128417e79a68e6e71e3ee4274b3c757bae0a51782ef027f3364681

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFirst Analysis Corporation

Victim entityFirst Analysis Corporation

Incidentdiscovered Aug 9, 2024

Stated responseTook a series of steps to contain the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov