HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

ON Q FINANCIAL, LLC

bd_48330967f1459ecf · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 20, 2024

Filed

Mar 29, 2024

To disclose

5 weeks

Affected

Not disclosed

Linked

14 filings

Confidence

65%

Full breach record for ON Q FINANCIAL, LLC →2 incidents on file

On Q Financial, LLC notified clients of a data security incident where an unknown individual accessed their network via a vulnerability in ConnectWise's ScreenConnect software. The intrusion occurred on March 14, 2023, but was discovered on February 20, 2024, when ConnectWise notified On Q Financial of the vulnerability. Client personal information, including names and Social Security numbers, was exfiltrated. On Q Financial patched the vulnerability, engaged forensic investigators, reported the incident to the FBI, and is offering credit monitoring and fraud assistance to affected clients.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d5 weeks discovery → filing

Incident timeline

undetected · 343 days

discovery → filing · 5 weeks / 38 days

Mar 14, 2023

Begins

Feb 20, 2024

Discovered

Mar 29, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 14 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitebianlianbd_ee592bde892a7b022024-04-06 · +8dVerified by operator

Regulatory filings (9) · sorted by filing gap

Illinois State AGbd_bca121f6a23d98442024-04-01 · +3dVerified by operator
Washington State AGbd_32dae1ae6ad3e6f42024-04-02 · +4dCandidate
California State AGbd_47866e35155e8f932024-04-02 · +4dVerified by operator
Maine State AGbd_70331c336a1897252024-04-02 · +4dVerified by operator

Show 5 more filings ↓up to 13d gap

Montana State AGbd_bfba92634c81bbdc2024-04-02 · +4dVerified by operator
South Carolina State AGbd_5fb90898a6e95a8e2024-04-03 · +5dVerified
New Hampshire State AGbd_a5faead4f3404bf82024-04-03 · +5dVerified by operator
Massachusetts State AGbd_d4ea7af3e6261a2d2024-04-03 · +5dVerified
Oregon State AGbd_b11839235c04d95c2024-04-11 · +13dVerified

Showing first 10 of 13 linked disclosures.

Name: ON Q FINANCIAL, LLC
norm: on q financial
Domain: onqfinancial.com

Name: ON Q FINANCIAL, LLC
norm: on q financial
Domain: onqfinancial.com
Industry: Financial Servicesllm

Discovered: Feb 20, 2024
Breach occurred: Mar 14, 2023
Undetected for: 343 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 29, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Reported this incident to the FBI
Third party: via ConnectWise
Initial access: supply_chain

During the incident: Immediately patched and upgraded the application
Began an investigation
Engaged a computer forensics investigation firm to conduct an independent investigation
Reported this incident to the FBI and will cooperate in any resulting investigation
Implemented additional measures to enhance the security of our network environment
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance
Changes made: Installed the patch
Implemented additional measures to enhance the security of our network environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Delaware State AGMar 29 · first · this page

Illinois State AG+3d

Washington State AG+4d

California State AG+4d

Maine State AG+4d

Montana State AG+4d

South Carolina State AG+5d

New Hampshire State AG+5d

Massachusetts State AG+5d

Oregon State AG+13d

Pattern: first filing Mar 29 (DE), last Apr 11 (OR) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 13 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2024/04/Sample-Notification-Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 29, 2024
Raw hash: 0138d3bad9dca3c94918f2034e97a4a3191f0fde4cae395fd28a837fc1c6fd25

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityON Q FINANCIAL, LLC

Victim entityON Q FINANCIAL, LLC

Incidentdiscovered Feb 20, 2024

Stated responseImmediately patched and upgraded the application

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov