Social EngineeringProfessional ServicesProfessional ServicesPhishingData ExfiltratedIdentity (basic)Government IDMediumContained

Garretson Resolution Group, Inc.

bd_67e4a21a0f62f7bc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 4, 2018

Filed

Aug 30, 2018

To disclose

21 weeks

Affected

3state residents only

Linked

3 filings

Confidence

64%

Full breach record for Garretson Resolution Group, Inc. →

Garretson Resolution Group, Inc. notified Montana residents of a phishing incident where attackers accessed employee email accounts between April 4 and May 4, 2018. The incident exposed names, addresses, dates of birth, and Social Security numbers. GRG secured accounts, engaged forensic firms, and offered one year of Experian IdentityWorks credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 weeks / 148 days

Apr 4, 2018

Begins

Apr 4, 2018

Discovered

Aug 30, 2018

Filed

vs. sector median

+2 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_dcb7aced5f62fb3f2018-08-30Verified
New Hampshire State AGbd_0d81fe6f462b13d42018-08-31 · +1dVerified

Name: Garretson Resolution Group, Inc.
norm: garretson resolution

Name: Garretson Resolution Group, Inc.
norm: garretson resolution
Industry: Professional Servicesllm

Discovered: Apr 4, 2018
Breach occurred: Apr 4, 2018 – May 4, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 30, 2018
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Secured the potentially affected employee e-mail accounts
Began an internal investigation
Engaged leading cyber security firms to assist with the investigation
Enhance the security of our systems
Attackers have been purged from GRG’s email environment
Arranged for you to receive a complimentary one-year membership of Experian’s ® IdentityWorksSM Credit 3B
Changes made: Taking additional steps to enhance our existing network security measures
Providing continued training to employees on the dangers of phishing e -mails
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(148 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGAug 30 · first

Montana State AGAug 30 · first · this page

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Garretson-Resolution-Group.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 30, 2018
Raw hash: 3ebb12796542d9919bb659d63e726766283201af44bd539e93d4c0dfa710fdc1

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityGarretson Resolution Group, Inc.

Victim entityGarretson Resolution Group, Inc.

Incidentdiscovered Apr 4, 2018

Stated responseSecured the potentially affected employee e-mail accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov