HackingRetail & ConsumerRetailDelayed DiscoveryCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

CWGS GROUP, LLC

bd_463d269ea5330f65 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 9, 2022

Filed

Aug 1, 2022

To disclose

25 weeks

Affected

549state residents only

Linked

7 filings

Confidence

69%

Full breach record for CWGS GROUP, LLC →

CWGS Group reported unauthorized access to its network from Jan 14 to Feb 13, 2022, discovered on Feb 9, 2022. 549 Washington residents were affected. Data included names, SSNs, driver's licenses, and financial account numbers. CWGS engaged forensic investigators, cooperated with law enforcement, and delayed notification per DOJ request. Notifications were sent Nov 7, 2022, with credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d25 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 26 days

discovery → filing · 25 weeks / 173 days

Jan 14, 2022

Begins

Feb 9, 2022

Discovered

Aug 1, 2022

Filed

vs. sector median

+17 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Maine State AGbd_e4c421a98d899f0e2022-11-03 · +94dVerified
Montana State AGbd_02549b552d2c91752022-11-07 · +98dVerified
New Hampshire State AGbd_0871f3eaea0b7fcd2022-11-07 · +98dVerified
Indiana State AGbd_2b4708491ac711442022-11-07 · +98dVerified

Show 2 more filings ↓up to 98d gap

Oregon State AGbd_378bfeb9fe0306a12022-11-07 · +98dVerified
Massachusetts State AGbd_78d4d412064ad9152022-11-07 · +98dVerified

Name: CWGS GROUP, LLC
norm: cwgs group

Name: CWGS GROUP, LLC
norm: cwgs group
Industry: Retail & Consumerllm

Discovered: Feb 9, 2022
Breach occurred: Jan 14, 2022 – Feb 13, 2022
Undetected for: 26 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 7, 2022
Affected individuals: 549state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthMilitary ID numberPassport number
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Cooperated with federal law enforcement’s investigationDelayed notification at the request of the Department of Justice

During the incident: Engaged a forensic security firm to investigate and secure its computer systems
Controlled the incident by preventing further access to the system
Cooperated with federal law enforcement’s investigation
Delayed notification at the request of the Department of Justice
Notifying the residents of the incident by letter
Offering twelve (12) months of complimentary credit monitoring and identity theft protection
Changes made: Enhancing its technical security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(173 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Washington State AGAug 1 · first · this page

Maine State AG+94d

Montana State AG+98d

New Hampshire State AG+98d

Indiana State AG+98d

Oregon State AG+98d

Massachusetts State AG+98d

Pattern: first filing Aug 1 (WA), last Nov 7 (MA) — a 98-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14044.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 1, 2022
Raw hash: 62a0f6ff352b7280abc1595d53a8010713374ffbb2937f558d0db8560c0113d8

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityCWGS GROUP, LLC

Victim entityCWGS GROUP, LLC

Incidentdiscovered Feb 9, 2022

Stated responseEngaged a forensic security firm to investigate and secure its computer systems

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com