PhysicalFinancial ServicesFinanceLossCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

CNG Financial Corporation Inc

bd_46c31a8c89a14125 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2018

Filed

Aug 15, 2018

To disclose

4 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for CNG Financial Corporation Inc →

CNG Financial Corporation, Inc. reported the loss of a USB drive containing customer names, addresses, Social Security numbers, and loan information. The drive was mailed to a third-party vendor via UPS on July 11, 2018, and reported missing on July 16, 2018, when the package arrived damaged. CNG launched an investigation with UPS and offered one year of credit monitoring and identity restoration services to affected individuals. No evidence suggests the data was accessed by unauthorized parties.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 16, 2018 → Notified Aug 15, 201830d ✓ CA 60-day OK4 weeks discovery → filing

Incident timeline

undetected · 5 days

discovery → filing · 4 weeks / 30 days

Jul 11, 2018

Begins

Jul 16, 2018

Discovered

Aug 15, 2018

Filed

vs. sector median

5 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_35e34a31ccfff62d2018-08-15Verified
Massachusetts State AGbd_7a724efa746b2d232018-08-15Verified
New Hampshire State AGbd_9c952458ca59ce452018-08-03 · +12dCandidate
South Carolina State AGbd_7e6143764786e1a12018-08-28 · +13dVerified

Name: CNG Financial Corporation Inc
norm: cng financial

Name: CNG Financial Corporation Inc
norm: cng financial
Industry: Financial Servicesllm

Discovered: Jul 16, 2018
Breach occurred: Jul 11, 2018 – Jul 16, 2018
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 15, 2018
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Providing notice to other state regulators
Third party: via UPS

During the incident: Launched an investigation with the assistance of UPS
Offering affected individuals complimentary access to one year of free credit monitoring and identity restoration services through AllClear
Providing potentially affected individuals with information on how to protect against identity theft and fraud
Changes made: Continuously working to enhance its own security measures
Provide training and education to its employees to prevent similar future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: CA 60-day OK · 30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 16, 2018
→ Notified: Aug 15, 2018
30d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 16, 2018 → Notified: Aug 15, 2018	30d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

New Hampshire State AGAug 3 · first

Montana State AG+12d

Massachusetts State AG+12d

California State AG+12d · this page

South Carolina State AG+25d

Pattern: first filing Aug 3 (NH), last Aug 28 (SC) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-138904
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 15, 2018
Raw hash: d37ac6744ae36800c15ce2f1c2da93697b2c36fe2a11656faf95435b59bfe524

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCNG Financial Corporation Inc

Victim entityCNG Financial Corporation Inc

Incidentdiscovered Jul 16, 2018

Stated responseLaunched an investigation with the assistance of UPS

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov