HackingCustomer Data InvolvedDelayed DiscoveryPIIIdentity (basic)Government IDMediumContained

MCKISSOCK INVESTMENT HOLDINGS, LLC

bd_6921e3ca4019aca4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

May 1, 2020

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

74%

Full breach record for MCKISSOCK INVESTMENT HOLDINGS, LLC →

McKissock Investment Holdings, LLC notified the California AG of unauthorized access to a legacy virtual server between November 16, 2019 and March 4, 2020. The affected data included names and driver's license or state identification numbers. The incident was discovered on or about March 26, 2020 when a data review confirmed personal information was present. McKissock disabled access to the server, engaged forensic investigators, and offered 12 months of NortonLifeLock identity monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 16, 2019

Begins

May 1, 2020

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_0a625461f49a52512020-05-01Candidate
Indiana State AGbd_0f50b9b3de1e72542020-05-01Verified
Massachusetts State AGbd_d2ec6fcf963deed22020-05-01Verified

Name: MCKISSOCK INVESTMENT HOLDINGS, LLC
norm: mckissock investment

Name: MCKISSOCK INVESTMENT HOLDINGS, LLC
norm: mckissock investment

Discovered: —
Breach occurred: Nov 16, 2019 – Mar 4, 2020
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Provided relevant regulatory notices to California AG

During the incident: Immediately began an investigation with the assistance of third-party forensic investigators
Quickly disabled access to the affected server
Began a thorough review of the contents of the server to determine whether sensitive information was present at the time of the incident
Secured the services of NortonLifeLock, Inc. to provide identity and credit monitoring services at no cost to affected individuals for twelve (12) months
Changes made: Implemented increased security measures
Conducted additional employee training
Currently reviewing our policies and procedures relating to data security
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGMay 1 · first

Indiana State AGMay 1 · first

Massachusetts State AGMay 1 · first

California State AGMay 1 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-189649
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 1, 2020
Raw hash: 821984e46995b96261e44326da154c9c306ce0fd7e63b8a85c87a075a9d30f6b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMCKISSOCK INVESTMENT HOLDINGS, LLC

Victim entityMCKISSOCK INVESTMENT HOLDINGS, LLC

IncidentUnauthorized Access

Stated responseImmediately began an investigation with the assistance of third-party forensic investigators

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov