HackingFinancial ServicesFinanceVulnerability ExploitData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDMediumContained

ON Q FINANCIAL, LLC

bd_47866e35155e8f93 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 20, 2024

Filed

Apr 2, 2024

To disclose

6 weeks

Affected

Not disclosed

Linked

14 filings

Confidence

64%

Full breach record for ON Q FINANCIAL, LLC →2 incidents on file

On Q Financial, LLC notified clients of a data security incident where an unknown individual exploited a vulnerability in ConnectWise's ScreenConnect software to access the company's network on March 14, 2023. The breach was discovered on February 20, 2024, when ConnectWise alerted On Q Financial to the vulnerability. The investigation confirmed that personal information, including names and Social Security numbers, was exfiltrated. On Q Financial patched the vulnerability, engaged forensic investigators, reported the incident to the FBI, and is offering 12 months of credit monitoring and fraud assistance to affected clients.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d6 weeks discovery → filing

Incident timeline

undetected · 343 days

discovery → filing · 6 weeks / 42 days

Mar 14, 2023

Begins

Feb 20, 2024

Discovered

Apr 2, 2024

Filed

vs. sector median

3 wks faster

This filing is one of 14 about the same incident.View merged incident

A leak claim by bianlian about this victim predates this filing by 42 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitebianlianbd_ee592bde892a7b022024-04-06 · +4dVerified by operator

Regulatory filings (9) · sorted by filing gap

Washington State AGbd_32dae1ae6ad3e6f42024-04-02Candidate
Maine State AGbd_70331c336a1897252024-04-02Verified by operator
Montana State AGbd_bfba92634c81bbdc2024-04-02Verified by operator
South Carolina State AGbd_5fb90898a6e95a8e2024-04-03 · +1dVerified

Show 5 more filings ↓up to 9d gap

New Hampshire State AGbd_a5faead4f3404bf82024-04-03 · +1dVerified by operator
Massachusetts State AGbd_d4ea7af3e6261a2d2024-04-03 · +1dVerified
Illinois State AGbd_bca121f6a23d98442024-04-01 · +1dVerified by operator
Indiana State AGbd_195d1d831b9193992024-03-29 · +4dVerified by operator
Oregon State AGbd_b11839235c04d95c2024-04-11 · +9dVerified

Showing first 10 of 13 linked disclosures.

Name: ON Q FINANCIAL, LLC
norm: on q financial
Domain: onqfinancial.com

Name: ON Q FINANCIAL, LLC
norm: on q financial
Domain: onqfinancial.com
Industry: Financial Servicesllm

Discovered: Feb 20, 2024
Breach occurred: Mar 14, 2023
Undetected for: 343 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 29, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Reported this incident to the FBI
Third party: via ConnectWise
Initial access: exploit_public_facing

During the incident: Patched and upgraded the ScreenConnect application
Engaged a computer forensics investigation firm to conduct an independent investigation
Reported this incident to the FBI and will cooperate in any resulting investigation
Implemented additional measures to enhance the security of our network environment
Changes made: Implemented additional measures to enhance the security of our network environment
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge for 12 months
Providing proactive fraud assistance through Cyberscout through Identity Force
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: Leak >30dCA 60-day OK · 38d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 20, 2024
→ Notified: Mar 29, 2024
38d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 20, 2024 → Notified: Mar 29, 2024	38d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Indiana State AGMar 29 · first

Illinois State AG+3d

Washington State AG+4d

Maine State AG+4d

Montana State AG+4d

California State AG+4d · this page

South Carolina State AG+5d

New Hampshire State AG+5d

Massachusetts State AG+5d

Oregon State AG+13d

Pattern: first filing Mar 29 (IN), last Apr 11 (OR) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 13 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-583432
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 2, 2024
Raw hash: ce60fe629b2a366fbe629c07aa61c2059eec2421b2cf23b519508403eb3b1956

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityON Q FINANCIAL, LLC

Victim entityON Q FINANCIAL, LLC

Incidentdiscovered Feb 20, 2024

Stated responsePatched and upgraded the ScreenConnect application

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov