MalwareFinancial ServicesFinanceRansomwareStolen CredentialsData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedMulti-Stage ChainFinancial accountHealth (basic)Identity (basic)Government IDPHIHighContained

CITYWIDE HOME LOANS, LLC

bd_6a666b75ee10fc92 · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 29, 2020

Filed

Mar 19, 2021

To disclose

16 weeks

Affected

2,407state residents only

Linked

11 filings

Confidence

69%

Full breach record for CITYWIDE HOME LOANS, LLC →

Citywide Home Loans, LLC reported a ransomware incident affecting 2,407 Washington residents. Unauthorized access occurred via stolen employee credentials on Nov 18, 2020. Ransomware encrypted servers, and data was exfiltrated to Mega. Data included PII, SSNs, financial info, and health plan data. Notifications began Feb 12, 2021. Remediation included moving to cloud, password resets, and enhanced controls.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d16 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 11 days

discovery → filing · 16 weeks / 110 days

Nov 18, 2020

Begins

Nov 29, 2020

Discovered

Mar 19, 2021

Filed

vs. sector median

+6 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Oregon State AGbd_cabec362322632042021-03-19Verified
Maine State AGbd_e8ea5bf83df4ef802021-03-19Verified
New Hampshire State AGbd_b6b664bb7002940c2021-03-22 · +3dVerified
Maine State AGbd_bd7db8214abdd3ba2021-03-25 · +6dVerified

Show 6 more filings ↓up to 77d gap

California State AGbd_5b65411c4f7f434c2021-02-16 · +31dVerified
Indiana State AGbd_386c31b538e6f36e2021-02-12 · +35dVerified
Montana State AGbd_d0e27bedc188f9fb2021-02-12 · +35dVerified
Maine State AGbd_2702f95acf3ad78e2021-02-11 · +36dCandidate
Massachusetts State AGbd_eff1d4dd668484382021-02-11 · +36dVerified
Illinois State AGbd_b2b84e4a4a13639a2021-01-01 · +77dVerified

Name: CITYWIDE HOME LOANS, LLC
norm: citywide home loans
Domain: citywidehomeloans.com

Name: CITYWIDE HOME LOANS, LLC
norm: citywide home loans
Domain: citywidehomeloans.com
Industry: Financial Servicesllm

Discovered: Nov 29, 2020
Breach occurred: Nov 18, 2020 – Nov 29, 2020
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 12, 2021
Affected individuals: 2,407state-resident count only
Data types: Financial accountHealth (basic)Identity (basic)Government IDPHI
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthPassport numberHealth insurance ID
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported the incident to law enforcement
Initial access: valid_credentials

During the incident: Took a number of its systems offline as a precautionary measure
Engaged external cybersecurity experts to assist it in responding to the incident
Reported the incident to law enforcement
Began notifying these individuals on February 12, 2021 via U.S. mail
Began notifying these individuals on March 19, 2021
Established a call center to respond to individuals’ questions
Offering to provide individuals 24 months of free identity theft and credit monitoring services through Kroll
Changes made: Accelerated a preexisting plan to move all of its technology infrastructure out of its data centers and into the cloud environment of Citywide’s parent company
Conducted a password reset
Strengthened endpoint and Active Directory controls
Enhanced its logging and monitoring implementation
Strengthened email filtering controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(110 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 9 states

View merged incident ↗

Illinois State AGJan 1 · first

Maine State AG+41d

Massachusetts State AG+41d

Indiana State AG+42d

Montana State AG+42d

California State AG+46d

Oregon State AG+77d

Maine State AG+77d

Washington State AG+77d · this page

New Hampshire State AG+80d

Maine State AG+83d

Pattern: first filing Jan 1 (IL), last Mar 25 (ME) — a 83-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10432.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 19, 2021
Raw hash: ee09984d6ba36dee03d26680aae3271b81579f8e8199831e1a747e6f40b50d8c

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityCITYWIDE HOME LOANS, LLC

Victim entityCITYWIDE HOME LOANS, LLC

Incidentdiscovered Nov 29, 2020

Stated responseTook a number of its systems offline as a precautionary measure

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com