Social EngineeringPhishingCustomer Data InvolvedPIICREDENTIALSLowContained
Archwest Funding, LLC and Archwest Lending, LLC
bd_5d73470fcbe46303 · schema v1 · pii pii-v1
Full breach record for Archwest Funding, LLC and Archwest Lending, LLC →Archwest Funding, LLC and Archwest Lending, LLC disclosed a data security incident in Massachusetts. On May 12, 2026, Archwest identified unauthorized access to an employee email account resulting from a deceptive message (phishing) on January 23, 2026. The attacker may have viewed emails and attachments containing personal information. Archwest secured the account, terminated access, and offered 24 months of identity theft protection services to affected individuals.
Massachusetts clock✓ MA AG ≤30d20 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_77be2841aa8a374bNew Hampshire State AGfiled 2026-06-30(29d gap)Verified
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-1070-archwest-funding-llc-and-archwest-lending-llc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 1, 2026
- Raw hash
- 5ace5c4236e0ba9b8734e487da21073acdbe5da245053556e316d2c0a57a1b9f
Reporting entity
- Name
- Archwest Funding, LLC and Archwest Lending, LLCnorm: archwest funding llc and archwest lending
Victim entity
- Name
- Archwest Funding, LLC and Archwest Lending, LLCnorm: archwest funding llc and archwest lending
Incident
- Discovered
- May 12, 2026
- Materiality determined
- —
- Notification sent
- Jun 25, 2026
- Affected individuals
- Not disclosed
- Data types
- PIICREDENTIALS
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 20 days(20 days from discovery to filing)
- Compliance flags
- MA AG ≤30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.