MalwareFinancial ServicesFinanceRansomwareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)LowContained

Caravus LLC

bd_70daf2399320562a · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 26, 2021

Filed

May 28, 2021

To disclose

5 weeks

Affected

7state residents only

Linked

5 filings

Confidence

66%

Full breach record for Caravus LLC →2 incidents on file

Caravus LLC notified individuals of a data security incident involving third-party provider Netgain Technology, LLC. Netgain experienced a ransomware attack in November 2020. Caravus learned in April 2021 that legacy data from a 2015 migration was not destroyed and may have been accessed by an unknown actor. Data involved included names and other personal information. Caravus terminated the relationship with Netgain and offered 12 months of credit monitoring and identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 176 days

discovery → filing · 5 weeks / 32 days

Nov 1, 2020

Begins

Apr 26, 2021

Discovered

May 28, 2021

Filed

vs. sector median

5 wks faster

This filing is one of 5 about the same incident.View merged incident

Part of Netgain Networks supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_487a45a21bdb402a2021-05-28Verified
Maine State AGbd_9114a5d451b23d6e2021-05-28Verified by operator
Indiana State AGbd_d17144e345d55dfb2021-05-28Verified
New Hampshire State AGbd_8c13b776e6000fe92021-06-07 · +10dVerified

Name: Caravus LLC
norm: caravus

Name: Caravus LLC
norm: caravus
Industry: Financial Servicesllm

Discovered: Apr 26, 2021
Breach occurred: Nov 1, 2020
Undetected for: 176 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 28, 2021
Affected individuals: 7state-resident count only
Data types: Identity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Netgain reported the incident to law enforcement
Third party: via Netgain Technology, LLC

During the incident: Moved quickly to investigate and respond
No longer using Netgain as a service provider
Offering identity theft protection services through IDX
Provided twelve (12) months of credit and CyberScan monitoring
Provided a $1,000,000 insurance reimbursement policy
Provided fully managed id theft recovery services
Changes made: Taken and continues to take steps to further strengthen its policies, procedures and existing security measures
Strengthened security measures in place at its third-party vendors
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGMay 28 · first

Maine State AGMay 28 · first

Indiana State AGMay 28 · first

Montana State AGMay 28 · first · this page

New Hampshire State AG+10d

Pattern: first filing May 28 (MA), last Jun 7 (NH) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/caravus-notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 28, 2021
Raw hash: 8181a142e3e0ef46e59949dcf9446753d0da9df6de2c0dc0ab6a03b433e03e10

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCaravus LLC

Victim entityCaravus LLC

Incidentdiscovered Apr 26, 2021

Stated responseMoved quickly to investigate and respond

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov