ON Q FINANCIAL, LLC
bd_47866e35155e8f93 · schema v1 · pii pii-v1
Full breach record for ON Q FINANCIAL, LLC →On Q Financial, LLC notified clients of a data security incident where an unknown individual exploited a vulnerability in ConnectWise's ScreenConnect software to access the company's network on March 14, 2023. The breach was discovered on February 20, 2024, when ConnectWise alerted On Q Financial to the vulnerability. The investigation confirmed that personal information, including names and Social Security numbers, was exfiltrated. On Q Financial patched the vulnerability, engaged forensic investigators, reported the incident to the FBI, and is offering 12 months of credit monitoring and fraud assistance to affected clients.
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_70331c336a189725Maine State AGfiled 2024-04-02Verified
- bd_a5faead4f3404bf8New Hampshire State AGfiled 2024-04-03(1d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-583432
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 2, 2024
- Raw hash
- ce60fe629b2a366fbe629c07aa61c2059eec2421b2cf23b519508403eb3b1956
Reporting entity
- Name
- ON Q FINANCIAL, LLCnorm: on q financial
- Domain
- onqfinancial.com
Victim entity
- Name
- ON Q FINANCIAL, LLCnorm: on q financial
- Domain
- onqfinancial.com
Incident
- Discovered
- Feb 20, 2024
- Materiality determined
- —
- Notification sent
- Mar 29, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Reported this incident to the FBI
- Third party
- via ConnectWise
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 6 weeks(42 days from discovery to filing)
- Compliance flags
- Leak >30dCA 60-day OK · 38d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 20, 2024→ Notified: Mar 29, 202438d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.