HackingFinancial ServicesFinanceStolen CredentialsPhishingMulti-Stage ChainCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Wingate Wealth Advisors

bd_43655eca27a5f3a4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 1, 2019

Filed

Apr 16, 2019

To disclose

11 weeks

Affected

3state residents only

Linked

3 filings

Confidence

66%

Full breach record for Wingate Wealth Advisors →

Wingate Wealth Advisors notified NH AG of unauthorized access to employee email accounts. Access occurred Jan 9-Feb 1, 2019 and Feb 19-27, 2019. Data included names, SSNs, driver's licenses, and financial account info. 3 NH residents notified. Remediation included password resets, security monitoring, and 2 years of identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 23 days

discovery → filing · 11 weeks / 74 days

Jan 9, 2019

Begins

Feb 1, 2019

Discovered

Apr 16, 2019

Filed

vs. sector median

+2 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_007faab6fbf00f192019-04-16Verified
Massachusetts State AGbd_7edca1b111601f112019-04-11 · +5dCandidate

Name: ECKERT SEAMANS CHERIN & MELLOTT, LLC
norm: eckert seamans cherin mellott

Name: Wingate Wealth Advisors
norm: wingate wealth advisors
Industry: Financial Servicesllm

Discovered: Feb 1, 2019
Breach occurred: Jan 9, 2019 – Feb 27, 2019
Undetected for: 23 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 10, 2019
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Reset the passwords of the impacted email accounts
Notified the brokerage custodians which hold most of Wingate ' s clients' funds of the incidents
Continues to work with its information security experts to assure that it is doing everything possible to protect the financial information of its clients
Added new security features to its email accounts and strengthened its security monitoring
Provided additional training to Wingate 's staff on how to avoid the methods that unauthorized individuals used to gain access to its email
Changes made: Provided notice of this incident to appropriate state regulators
Offered two years of identity theft protection services, at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(74 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Massachusetts State AGApr 11 · first

Massachusetts State AG+5d

New Hampshire State AG+5d · this page

Pattern: first filing Apr 11 (MA), last Apr 16 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/wingate-20190416.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 16, 2019
Raw hash: 94a76a0b9b556045d4cb943de20bd74822ac7496579351d56f0839cebdcc7a9e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityECKERT SEAMANS CHERIN & MELLOTT, LLC

Victim entityWingate Wealth Advisors

Incidentdiscovered Feb 1, 2019

Stated responseReset the passwords of the impacted email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov