HackingFinancial ServicesFinanceVulnerability ExploitStolen CredentialsTargetedIdentity (basic)CredentialsLowContained

CUSO Financial Services, L.P.

bd_4ed0f902278f502d · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 20, 2023

Filed

Feb 16, 2024

To disclose

17 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

65%

Full breach record for CUSO Financial Services, L.P. →5 incidents on file

CUSO Financial Services, LP notified consumers of a data breach involving an email security event. An unauthorized party exploited a vulnerability in Barracuda Networks email application to access historical emails and attachments dating back to July 5, 2022. The incident potentially exposed names and other personal information. CFS reported the event to federal law enforcement and offered complimentary credit monitoring through Experian.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday17 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 472 days

discovery → filing · 17 weeks / 119 days

Jul 5, 2022

Begins

Oct 20, 2023

Discovered

Feb 16, 2024

Filed

vs. sector median

+9 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_07db9bec418ab63b2024-02-16Verified
Indiana State AGbd_5e7d3bbb2432fd7d2024-02-16Verified
California State AGbd_7dfd4f2b42eb5c012024-02-16Verified
Montana State AGbd_8322500873ed6ac42024-02-16Verified

Show 2 more filings ↓

Maine State AGbd_9c6021565739f1562024-02-16Verified
New Hampshire State AGbd_efcb6767e0e2d8262024-02-16Verified

Name: CUSO Financial Services, L.P.
norm: cuso financial

Name: CUSO Financial Services, L.P.
norm: cuso financial
Industry: Financial Servicesllm

Discovered: Oct 20, 2023
Breach occurred: Jul 5, 2022
Undetected for: 472 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 16, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: the event was reported to federal law enforcement
Initial access: exploit_public_facing

During the incident: Confirmed that the vulnerability was closed
Assessed any potentially impacted accounts to notify affected individuals
The event was reported to federal law enforcement
Offering you access to ## months of complimentary monitoring and identity restoration services through Experian
Changes made: Confirmed that the vulnerability was closed
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(119 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Massachusetts State AGFeb 16 · first

Indiana State AGFeb 16 · first

California State AGFeb 16 · first

Montana State AGFeb 16 · first

Maine State AGFeb 16 · first

New Hampshire State AGFeb 16 · first

Vermont State AGFeb 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-02-16-cuso-financial-services-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 16, 2024
Raw hash: 0fdac1e6e4afa6b1aacd17a66e62c01a194a4b6ff3e1b4dc4c084fe070c4e702

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityCUSO Financial Services, L.P.

Victim entityCUSO Financial Services, L.P.

Incidentdiscovered Oct 20, 2023

Stated responseConfirmed that the vulnerability was closed

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov