HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedAuthenticationFinancial accountFinancial credentialsHealth (basic)Identity (basic)Government IDPHIHighContained

FPI Management

bd_6879a8ce866ccd72 · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 14, 2020

Filed

Apr 2, 2021

To disclose

33 weeks

Affected

1,022state residents only

Linked

7 filings

Confidence

70%

Full breach record for FPI Management →3 incidents on file

FPI Management, a property management company, notified 1,022 Washington residents of a data security incident discovered on August 14, 2020. An unauthorized third party accessed systems containing names, SSNs, driver's licenses, financial account info, and medical data. FPI engaged forensic experts, notified the FBI, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d33 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

discovery → filing · 33 weeks / 231 days

Aug 14, 2020

Discovered

Apr 2, 2021

Filed

vs. sector median

+14 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_49d8aa1c9cc172bf2021-04-15 · +13dVerified
Indiana State AGbd_ef3a2b6c0362002c2021-04-15 · +13dVerified
Massachusetts State AGbd_3495a6f1afac2d172021-04-16 · +14dVerified
Montana State AGbd_5a9851f19a551c3c2021-04-16 · +14dVerified

Show 2 more filings ↓up to 14d gap

New Hampshire State AGbd_c98b7038418770b82021-04-16 · +14dVerified
Maine State AGbd_f07935644acc0a772021-04-16 · +14dVerified by operator

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: FPI Management
norm: fpi management
Industry: Professional Servicesllm

Discovered: Aug 14, 2020
Materiality determined: —
Notification sent: Apr 2, 2021
Affected individuals: 1,022state-resident count only
Data types: AuthenticationFinancial accountFinancial credentialsHealth (basic)Identity (basic)Government IDPHI
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthUnique private keyMedical informationUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified Washington Attorney General

During the incident: Took immediate steps to secure its systems prior to restoration
Retained independent cybersecurity experts to conduct an investigation
Implemented additional security measures to further harden its digital environment
Reported this incident to the Federal Bureau of Investigation
Offered complimentary identity theft protection services through Experian IdentityWorks
Changes made: Implemented additional security measures to further harden its digital environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(231 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Washington State AGApr 2 · first · this page

California State AG+13d

Indiana State AG+13d

Massachusetts State AG+14d

Montana State AG+14d

New Hampshire State AG+14d

Maine State AG+14d

Pattern: first filing Apr 2 (WA), last Apr 16 (ME) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10436.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 2, 2021
Raw hash: 4713eca9348f074219a90ec1f0accf9758b6e3b0b032d158e6d940e1d9e2e6ad

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityFPI Management

Incidentdiscovered Aug 14, 2020

Stated responseTook immediate steps to secure its systems prior to restoration

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com