HackingVulnerability ExploitStolen CredentialsTargetedIDENTITY_BASICCREDENTIALSLowContained
CUSO Financial Services, L.P.
bd_4ed0f902278f502d · schema v1 · pii pii-v1
Full breach record for CUSO Financial Services, L.P. →CUSO Financial Services, LP notified consumers of a data breach involving an email security event. An unauthorized party exploited a vulnerability in Barracuda Networks email application to access historical emails and attachments dating back to July 5, 2022. The incident potentially exposed names and other personal information. CFS reported the event to federal law enforcement and offered complimentary credit monitoring through Experian.
Vermont clock✗ VT AG >45 bday17 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Source provenance
- Source URL
- https://ago.vermont.gov/document/2024-02-16-cuso-financial-services-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 16, 2024
- Raw hash
- 0fdac1e6e4afa6b1aacd17a66e62c01a194a4b6ff3e1b4dc4c084fe070c4e702
Reporting entity
- Name
- CUSO Financial Services, L.P.norm: cuso financial
Victim entity
- Name
- CUSO Financial Services, L.P.norm: cuso financial
Incident
- Discovered
- Oct 20, 2023
- Materiality determined
- —
- Notification sent
- Feb 16, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICCREDENTIALS
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- the event was reported to federal law enforcement
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 17 weeks(119 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.