HackingFinancial ServicesFinanceCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIIdentity (basic)Government IDHealth (basic)MediumContained

US Merchants Financial Group, Inc.

bd_6c21bfc35c75c7bc · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Sep 6, 2024

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

72%

Full breach record for US Merchants Financial Group, Inc. →

On or around February 13, 2024, an unauthorized third party gained access to the network of US Merchants Financial Group, Inc. and The Merchant of Tennis, Inc. and acquired certain files. The investigation concluded on or about August 2, 2024. Affected data included names, driver's license numbers, alien registration numbers, passport numbers, health information, and Social Security numbers. Notification letters were sent September 3, 2024.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 13, 2024

Begins

Sep 6, 2024

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_d02fb693b398f1022024-09-03 · +3dVerified

Name: US Merchants Financial Group, Inc.
norm: us merchants financial

Name: US Merchants Financial Group, Inc.
norm: us merchants financial
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Feb 13, 2024
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government IDHealth (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated CollectionT1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Promptly began taking steps to secure our systems
Engaged third-party specialists to assist with securing the network environment and investigating the incident
Reported the incident to law enforcement
Providing access to credit monitoring and fraud assistance services at no charge through Cyberscout / Identity Force (TransUnion) for twelve (12) months
Changes made: Implemented measures to further enhance the security of our network environment
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGSep 3 · first

California State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-591299
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 6, 2024
Raw hash: acb98b54a1a0ca1c68d1aab2d71b1f73ab77219d73a3d37e34d4523645211eee

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityUS Merchants Financial Group, Inc.

Victim entityUS Merchants Financial Group, Inc.

IncidentUnauthorized Access

Stated responsePromptly began taking steps to secure our systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov