HackingTechnologyInformationStolen CredentialsPIIIdentity (basic)LowActive

Signature Performance

bd_43ac19f0de3e7ddb · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 18, 2024

Filed

Feb 12, 2024

To disclose

25 days

Affected

41state residents only

Linked

11 filings

Confidence

64%

Full breach record for Signature Performance →

Signature Performance, Inc. notified Montana residents of a data breach where an unknown party accessed network files between Jan 17-18, 2024. Suspicious activity was detected on Jan 18. The company engaged third-party specialists, notified law enforcement, and is offering credit monitoring. Data types are under review.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 25 days

Jan 17, 2024

Begins

Jan 18, 2024

Discovered

Feb 12, 2024

Filed

vs. sector median

15 wks faster

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitedispossessorbd_d1478747c36b95f02024-02-26 · +14dVerified by operator
Leak Sitemedusabd_8ffebe88e2a8bc502024-01-24 · +19dVerified by operator

Regulatory filings (8) · sorted by filing gap

New Hampshire State AGbd_0a96e2de88613a0e2024-02-12Verified by operator
Massachusetts State AGbd_4b58461a96387c192024-02-10 · +2dVerified by operator
Indiana State AGbd_84b9766c9b8ca4842024-02-09 · +3dVerified by operator
Vermont State AGbd_a3ef04fc7d3269972024-02-09 · +3dVerified by operator

Show 4 more filings ↓up to 121d gap

Maine State AGbd_c486c4540e26b49d2024-02-09 · +3dVerified by operator
HHS OCRbd_1feed69b36367c1d2024-06-10 · +119dVerified by operator
Vermont State AGbd_d1571ee5429da6cc2024-06-10 · +119dVerified by operator
Massachusetts State AGbd_9846955b811b34542024-06-12 · +121dVerified by operator

Name: Signature Performance
norm: signature performance
Domain: signatureperformance.com

Name: Signature Performance
norm: signature performance
Domain: signatureperformance.com
Industry: Technologyllm

Discovered: Jan 18, 2024
Breach occurred: Jan 17, 2024 – Jan 18, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Feb 9, 2024
Affected individuals: 41state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified law enforcement
Initial access: valid_credentials

During the incident: Notified law enforcement
Conducting a thorough investigation with the assistance of third-party specialists
Implemented an array of additional security measures
Offering complimentary credit monitoring and identity protection services
Changes made: Implemented an array of additional security measures to further confirm the security of our network and minimize the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 7 states

View merged incident ↗

Indiana State AGFeb 9 · first

Vermont State AGFeb 9 · first

Maine State AGFeb 9 · first

Massachusetts State AG+1d

New Hampshire State AG+3d

Montana State AG+3d · this page

HHS OCR+122d

Vermont State AG+122d

Massachusetts State AG+124d

Pattern: first filing Feb 9 (IN), last Jun 12 (MA) — a 124-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1095.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 12, 2024
Raw hash: 8fff2ca3ad2f97559b8fcab8949b37c879134ef396f9c01b9dc0348d93b34570

Linked disclosures

Ransomware claims (2)

Regulatory filings (8) · sorted by filing gap

Reporting entitySignature Performance

Victim entitySignature Performance

Incidentdiscovered Jan 18, 2024

Stated responseNotified law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov