Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsMulti-Stage ChainCustomer Data InvolvedPIIIdentity (basic)MediumContained

Movement Mortgage LLC

bd_506a3e8c60864867 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 1, 2018

Filed

Sep 4, 2018

To disclose

5 weeks

Affected

5,570state residents only

Linked

6 filings

Confidence

64%

Full breach record for Movement Mortgage LLC →4 incidents on file

Movement Mortgage, LLC notified South Carolina residents that employee email accounts were compromised via phishing between Oct 2017 and Mar 2018. Personal information of loan applicants was accessed. Movement engaged forensic investigators, reset credentials, implemented MFA, and offered 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due5 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 296 days

discovery → filing · 5 weeks / 34 days

Oct 9, 2017

Begins

Aug 1, 2018

Discovered

Sep 4, 2018

Filed

vs. sector median

4 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_6ff550f34d8ab1342018-09-04Verified
Oregon State AGbd_0728f76685a582862018-08-31 · +4dCandidate
California State AGbd_84611419ab4b36ef2018-08-31 · +4dVerified
Montana State AGbd_c5db8dad3fdbc5762018-08-31 · +4dVerified by operator

Show 1 more filing ↓up to 4d gap

Massachusetts State AGbd_e19737bfce8739492018-08-31 · +4dVerified

Name: Movement Mortgage LLC
norm: movement mortgage

Name: Movement Mortgage LLC
norm: movement mortgage
Industry: Financial Servicesllm

Discovered: Aug 1, 2018
Breach occurred: Oct 9, 2017 – Mar 29, 2018
Undetected for: 296 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 24, 2018
Affected individuals: 5,570state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Launched an investigation, with the assistance of a third party forensic investigator
Reset the email login credentials for all employee email accounts
Implementing additional training and education for employees
Monitoring all email accounts for suspicious log-ins
Implemented multi-factor authentication on all email accounts
Increased our Information Technology security staff
Implement additional system scanning and monitoring programs
Arranged to have Experian protect your identity for 1 year at no cost
Changes made: Implemented multi-factor authentication on all email accounts
Increased our Information Technology security staff
Implement additional system scanning and monitoring programs
Implementing additional training and education for employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Oregon State AGAug 31 · first

California State AGAug 31 · first

Montana State AGAug 31 · first

Massachusetts State AGAug 31 · first

New Hampshire State AG+4d

South Carolina State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/MovementMortgage.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 4, 2018
Raw hash: 852bcc11f8d389a757c1e573debce0cc97003d0b863d2e49c843035b5a030761

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMovement Mortgage LLC

Victim entityMovement Mortgage LLC

Incidentdiscovered Aug 1, 2018

Stated responseLaunched an investigation, with the assistance of a third party forensic investigator

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov