HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedDelayed DiscoveryPIIPHIIdentity (basic)LowContained

CSG CONSULTANTS, INC.

bd_6991a655f618d557 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Mar 20, 2025

To disclose

—

Affected

Not disclosed

Linked

6 filings

Confidence

67%

Full breach record for CSG CONSULTANTS, INC. →

In August 2024, CSG Consultants experienced unauthorized access to its network systems. The company disconnected affected systems, launched an investigation with independent forensic experts, and determined personal and health information may have been impacted. Notification letters were sent in March 2025, with IDX identity protection services offered to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 23, 2024

Begins

Mar 20, 2025

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteakirabd_13f71a462b089dbf2024-10-01 · +169dVerified by operator

Regulatory filings (4) · sorted by filing gap

Maryland State AGbd_521874af4fd77d612025-03-20Verified
Indiana State AGbd_8e658b94f4231ba12025-03-20Verified
New Hampshire State AGbd_e77fd88412f5f7ca2025-03-24 · +4dVerified
Massachusetts State AGbd_af25460a7ac08d502025-03-26 · +6dVerified by operator

Name: CSG CONSULTANTS, INC.
norm: csg consultants
Domain: csgengr.com

Name: CSG CONSULTANTS, INC.
norm: csg consultants
Domain: csgengr.com
Industry: Professional Servicesllm

Discovered: —
Breach occurred: Aug 23, 2024
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External

During the incident: Disconnected our systems
Began an investigation
Engaged independent computer forensic experts to assist
Changed passwords
Tightened endpoint monitoring controls
Offering identity theft protection services through IDX for 12/24 months
Changes made: Changed passwords
Tightened endpoint monitoring controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maryland State AGMar 20 · first

Indiana State AGMar 20 · first

California State AGMar 20 · first · this page

New Hampshire State AG+4d

Massachusetts State AG+6d

Pattern: first filing Mar 20 (MD), last Mar 26 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-600170
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 20, 2025
Raw hash: f7ba9d2c99ace33f285ad6730442ce3fa4bc041342246fe96a69711eb5ab080b

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityCSG CONSULTANTS, INC.

Victim entityCSG CONSULTANTS, INC.

IncidentUnauthorized Access

Stated responseDisconnected our systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov