HackingFinancial ServicesFinanceStolen CredentialsCapture App DataCustomer Data InvolvedData ExfiltratedDelayed DiscoveryPIILowContained
Kevin Grunawalt
bd_54017bc68b5c05c2 · schema v1 · pii pii-v1
Full breach record for Kevin Grunawalt →Kevin Grunawalt d/b/a Verso Financial (Mishawaka, IN), a financial services firm, identified suspicious unauthorized access to an employee email account by an unknown external actor between October 31, 2023 and February 15, 2024. The breach was discovered on August 23, 2024. The actor had the capability to copy mailbox contents. 2 Maine residents were affected. Consumer notifications were sent September 24, 2024. Twelve months of Equifax credit monitoring via Epiq Global was offered.
Maine clockDiscovered Aug 23, 2024 → Filed with AG Sep 24, 202432d ⏱ ME AG >30d5 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_7c158b1a5e097e8bVermont State AGfiled 2024-10-09(15d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/5b3c2db8-cb7f-40fb-9ff5-509071228b39.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 24, 2024
- Raw hash
- c3764bb9f479e95ae8290a22759d6b0ee2e084cfd539e9727792ad9d1fa80c36
Reporting entity
- Name
- Kevin Grunawaltnorm: kevin grunawalt
- Domain
- versofinancial.com
- Industry
- Financial Services
Victim entity
- Name
- Kevin Grunawaltnorm: kevin grunawalt
- Domain
- versofinancial.com
- Industry
- Financial Services
- Industry
- Financial Servicesllm
Incident
- Discovered
- Aug 23, 2024
- Materiality determined
- —
- Notification sent
- Sep 24, 2024
- Affected individuals
- 2
- Data types
- PII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
Compliance
- Time to disclose
- 5 weeks(32 days from discovery to filing)
- Compliance flags
- ME AG >30d · 32d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Aug 23, 2024→ Filed with AG: Sep 24, 202432d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.