AccidentalProfessional ServicesProfessional ServicesMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Oxford Global Resources, LLC

bd_6061c33e6537d905 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 12, 2024

Filed

May 16, 2024

To disclose

13 weeks

Affected

10state residents only

Linked

6 filings

Confidence

65%

Full breach record for Oxford Global Resources, LLC →

Oxford Global Resources notified Montana employees of a security incident on May 13, 2024. On February 12, 2024, an employee inadvertently sent a file containing W2s (including names, SSNs, and addresses) to a former consultant. Oxford engaged legal counsel, isolated the file, and offered 12 months of credit monitoring. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 94 days

Feb 12, 2024

Begins

Feb 12, 2024

Discovered

May 16, 2024

Filed

vs. sector median

5 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_7300d761bc0faf4d2024-05-16Verified
Massachusetts State AGbd_7488fa3b3491832b2024-05-17 · +1dVerified
California State AGbd_14e552cf843b862c2024-05-15 · +1dVerified
Maine State AGbd_4f8aa4b7e23ccf622024-05-15 · +1dVerified

Show 1 more filing ↓up to 3d gap

Indiana State AGbd_44612519f2e9b80e2024-05-13 · +3dVerified

Name: Oxford Global Resources, LLC
norm: oxford global resources

Name: Oxford Global Resources, LLC
norm: oxford global resources
Industry: Professional Servicesllm

Discovered: Feb 12, 2024
Breach occurred: Feb 12, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 13, 2024
Affected individuals: 10state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1535 Untrusted External Source
Threat actor: Internal

During the incident: Hired a nationally recognized law firm to help with its investigation and remediation
Isolated and deleted the file from the recipient’s system
Deleted the email through which the file was issued
Confirmed that the file could not be forwarded and opened by unauthorized recipients
Performed searches of the dark web
Offering complimentary credit monitoring and identity restoration services
Changes made: Offering 12-months of complimentary credit monitoring service provided by TransUnion
Offering identity restoration services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(94 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGMay 13 · first

California State AG+2d

Maine State AG+2d

New Hampshire State AG+3d

Montana State AG+3d · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1371.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 16, 2024
Raw hash: 1a9f6c6293930a6e1224665a35e2110e35660232e25d7fe7ab5546b92a6b97e5

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityOxford Global Resources, LLC

Victim entityOxford Global Resources, LLC

Incidentdiscovered Feb 12, 2024

Stated responseHired a nationally recognized law firm to help with its investigation and remediation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov