HackingIdentity (basic)Government IDFinancial accountMediumContained

CALTON & ASSOCIATES, INC.

bd_5573d40fb788057a · schema v1 · pii pii-v2

Severity

Medium

Discovered

Mar 28, 2025

Filed

Jun 26, 2025

To disclose

—

Affected

273state residents only

Linked

9 filings

Confidence

66%

Full breach record for CALTON & ASSOCIATES, INC. →

Calton & Associates experienced unauthorized network access on March 28, 2025, affecting 273 Nebraska residents. Data included names, addresses, SSNs, and account numbers. The company reported the incident to the FBI, FINRA, and FTC, established a call center, and provided 12 months of credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

Incident timeline

Mar 28, 2025

Begins

Mar 28, 2025

Discovered

Jun 26, 2025

Filed

This filing is one of 9 about the same incident.View merged incident

A leak claim by cl0p about this victim predates this filing by 73 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_d41208bd0df5c4562025-04-13 · +73dVerified by operator

Regulatory filings (7) · sorted by filing gap

Montana State AGbd_15ff45acc8e418c62025-06-26Verified by operator
Massachusetts State AGbd_304579978ce6e1e82025-06-26Verified by operator
Washington State AGbd_6c8c5bac0f4c2f972025-06-26Verified by operator
California State AGbd_aeee1a1e6cfd8b062025-06-26Verified by operator

Show 3 more filings ↓up to 33d gap

Oregon State AGbd_d56e3cfbb0a0b9242025-06-30 · +4dVerified by operator
Illinois State AGbd_65c0b45d8c39dce52025-07-01 · +5dVerified
Massachusetts State AGbd_69979e8648007b882025-07-29 · +33dVerified by operator

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: CALTON & ASSOCIATES, INC.
norm: calton associates
Domain: calton.com

Discovered: Mar 28, 2025
Breach occurred: Mar 28, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 26, 2025
Affected individuals: 273state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: reported the event to the FBI and FINRA and also notified the Federal Trade Commission
Initial access: exploit_public_facing

During the incident: Conducted an immediate and comprehensive investigation to confirm the scope of the event to secure its network and to notify affected individuals
Reported the event to the FBI and FINRA and also notified the Federal Trade Commission
Established a toll-free call center through TransUnion to answer questions about the incident and to address related concerns
Continues to review policies and procedures and so it can implement additional measures as appropriate
Changes made: Implemented additional cybersecurity measures
Reported the event to the FBI and are fully cooperating with their investigation
Providing you with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Montana State AGJun 26 · first

Massachusetts State AGJun 26 · first

Washington State AGJun 26 · first

California State AGJun 26 · first

Nebraska State AGJun 26 · first · this page

Oregon State AG+4d

Illinois State AG+5d

Massachusetts State AG+33d

Pattern: first filing Jun 26 (MT), last Jul 29 (MA) — a 33-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/b143dcbf-87a2-4d23-a312-6201595d7f46.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 26, 2025
Raw hash: 8f63660b6c5157e0c48c2895367591809e3e24d4df905e4d7b9953bc692a3fee

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityCALTON & ASSOCIATES, INC.

Incidentdiscovered Mar 28, 2025

Stated responseConducted an immediate and comprehensive investigation to confirm the scope of the event to secure its network and to notify affected individuals

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancenebraska.gov