HackingFinancial ServicesFinanceCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDMediumContained

Challenge Financial Services, Inc.

bd_64d10a947c6e89a7 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Aug 31, 2026

Filed

Sep 29, 2026

To disclose

29 days

Affected

Not disclosed

Confidence

67%

Full breach record for Challenge Financial Services, Inc. →

Challenge Financial Services, Inc. disclosed a cyber incident where an unauthorized third party accessed its network from August 17-18, 2026. The company discovered the breach on August 31, 2026. Customer personal information, including names and Social Security Numbers, may have been viewed or taken. The company secured its networks, restored operations, notified law enforcement, and is offering 12 months of complimentary identity monitoring and restoration services through IdentityIQ.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 14 days

discovery → filing · 29 days

Aug 17, 2026

Begins

Aug 31, 2026

Discovered

Sep 29, 2026

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Challenge Financial Services, Inc.
norm: challenge financial

Name: Challenge Financial Services, Inc.
norm: challenge financial
Industry: Financial Servicesllm

Discovered: Aug 31, 2026
Breach occurred: Aug 17, 2026 – Aug 18, 2026
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified law enforcement

During the incident: Secured our networks
Initiated an investigation
Safely restored our systems and operations
Notified law enforcement
Providing access to credit monitoring and identity restoration services through IdentityIQ at no charge
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-630536
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 29, 2026
Raw hash: 1b89da481585b8f687d39e64c50c2636a6520cca5445fd703e8ef90cefbfb464

Reporting entityChallenge Financial Services, Inc.

Victim entityChallenge Financial Services, Inc.

Incidentdiscovered Aug 31, 2026

Stated responseSecured our networks

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov