Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsMulti-Stage ChainCustomer Data InvolvedPIIIdentity (basic)Financial accountFinancial credentialsLowContained

SOS INTERNATIONAL LLC

bd_4676f4ee6bdce74c · schema v1 · pii pii-v1

Severity

Low

Discovered

May 18, 2018

Filed

Jun 28, 2018

To disclose

6 weeks

Affected

2state residents only

Confidence

65%

Full breach record for SOS INTERNATIONAL LLC →

SOS International, LLC notified Montana residents of a data breach where attackers used phishing to steal employee credentials and access email accounts containing PII and credit card data. The incident occurred between Feb-Mar 2018, was discovered May 18, 2018. Affected data included names, emails, addresses, phone numbers, and credit card details. SOS engaged forensic experts, notified the FBI, and provided one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 102 days

discovery → filing · 6 weeks / 41 days

Feb 5, 2018

Begins

May 18, 2018

Discovered

Jun 28, 2018

Filed

vs. sector median

14 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: SOS INTERNATIONAL LLC
norm: sos international

Name: SOS INTERNATIONAL LLC
norm: sos international
Industry: Professional Servicesllm

Discovered: May 18, 2018
Breach occurred: Feb 5, 2018 – Mar 22, 2018
Undetected for: 102 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 28, 2018
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)Financial accountFinancial credentials
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: reported this incident to the Federal Bureau of Investigationwill notify the applicable state regulatory authorities, where required
Initial access: phishing_link

During the incident: Initiated an investigation
Terminated the attacker’s access to our email system
Engaged and utilized multiple cyber security experts to assist us in a forensic investigation
Reported this incident to the Federal Bureau of Investigation
Arranged for you to enroll, at no cost to you, in an online credit monitoring service (myTrueIdentity) for one year provided by TransUnion Interactive
Changes made: Implementing even more robust programs, policies, and procedures to prevent such an incident from occurring again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(41 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/SOS-Intl-LLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 28, 2018
Raw hash: f4da9ed9e9993d2256b782ff0e8552f5cf59d73691ff18507bbec877213c6d70

Reporting entitySOS INTERNATIONAL LLC

Victim entitySOS INTERNATIONAL LLC

Incidentdiscovered May 18, 2018

Stated responseInitiated an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov