HackingPIIIdentity (basic)MediumContained

Quatrro Business Support Services, Inc.

bd_4bfd9b46b32c693b · schema v1 · pii pii-v2

Severity

Medium

Discovered

Dec 7, 2025

Filed

Sep 10, 2026

To disclose

40 weeks

Affected

4,562state residents only

Linked

5 filings

Confidence

67%

Full breach record for Quatrro Business Support Services, Inc. →2 incidents on file

Quatrro Business Support Services, Inc. notified South Carolina residents of a security incident involving unauthorized access to files containing personal information of clients' employees and vendors. The breach occurred between November 11-19, 2025, and was discovered on December 7, 2025. Notifications were sent on August 20, 2026. Affected data includes names and other PII. Quatrro engaged Kroll to provide free identity monitoring services.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due40 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 26 days

discovery → filing · 40 weeks / 277 days

Nov 11, 2025

Begins

Dec 7, 2025

Discovered

Sep 10, 2026

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Washington State AGbd_046d408e4d7958cf2026-09-09 · +1dVerified
Oregon State AGbd_b7332845c87554b82026-09-09 · +1dVerified
California State AGbd_babb49f6339a98ac2026-09-09 · +1dVerified
Vermont State AGbd_dfeaa72bcad50f962026-09-09 · +1dCandidate

Name: Quatrro Business Support Services, Inc.
norm: quatrro business support

Name: Quatrro Business Support Services, Inc.
norm: quatrro business support

Discovered: Dec 7, 2025
Breach occurred: Nov 11, 2025 – Nov 19, 2025
Undetected for: 26 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 20, 2026
Affected individuals: 4,562state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the services of Kroll to provide identity monitoring
Notified clients
Implemented measures to strengthen security program
Changes made: Implemented measures to strengthen security program
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 40 weeks(277 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.