Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

Maps Credit Union

bd_426d9bc242a0349c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 11, 2020

Filed

Dec 16, 2020

To disclose

14 weeks

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Maps Credit Union →

Maps Credit Union notified members on Dec 16, 2020, of a data security incident discovered on Sept 11, 2020. An unauthorized individual accessed an employee email account via phishing, exposing member names and SSNs. The company engaged forensic investigators, secured the account, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 96 days

Sep 11, 2020

Begins

Sep 11, 2020

Discovered

Dec 16, 2020

Filed

vs. sector median

+5 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Oregon State AGbd_1a8071f878fd75c02020-12-16Candidate

Name: Maps Credit Union
norm: maps credit union

Name: Maps Credit Union
norm: maps credit union
Industry: Financial Servicesllm

Discovered: Sep 11, 2020
Breach occurred: Sep 11, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 16, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Disabled the unauthorized access to the account
Added security which would restrict access
Engaged a digital forensics firm
Increased security on our email system
Offering you information about steps you can take to help protect your personal information, including complimentary identity monitoring and recovery services for 12 months through a leading identity protection company called IDX
Changes made: Increased security on our email system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(96 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Oregon State AGDec 16 · first

Montana State AGDec 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Maps-Notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 16, 2020
Raw hash: 21f56f2003834fcae71c9c123648ed856e5ea973e858f72dd6c5f24be538936e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMaps Credit Union

Victim entityMaps Credit Union

Incidentdiscovered Sep 11, 2020

Stated responseDisabled the unauthorized access to the account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov