Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

Cumberland Advisors, LLC

bd_70f1d52df37b37f8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 5, 2023

Filed

Dec 20, 2023

To disclose

15 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

67%

Full breach record for Cumberland Advisors, LLC →

Cumberland Advisors, Inc. notified consumers on December 20, 2023, of unauthorized access to two employee email accounts between August 31 and September 5, 2023. The breach resulted from suspicious activity likely involving phishing, leading to credential compromise. Customer PII, including government IDs, was accessed. No misuse has been confirmed. Remediation included forensic investigation, security protocol enhancements, and complimentary credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday15 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 5 days

discovery → filing · 15 weeks / 106 days

Aug 31, 2023

Begins

Sep 5, 2023

Discovered

Dec 20, 2023

Filed

vs. sector median

+7 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_27f60e7defb708fc2023-12-20Candidate
Maine State AGbd_59e92d07c3db90cf2023-12-20Verified
Massachusetts State AGbd_838e5ce538017ce12023-12-20Verified
New Hampshire State AGbd_6ab5b3b9d1b51cd82024-02-14 · +56dVerified

Show 1 more filing ↓up to 56d gap

Maine State AGbd_e75969bf74119acf2024-02-14 · +56dCandidate

Name: Cumberland Advisors, LLC
norm: cumberland advisors

Name: Cumberland Advisors, LLC
norm: cumberland advisors
Industry: Financial Servicesllm

Discovered: Sep 5, 2023
Breach occurred: Aug 31, 2023 – Sep 5, 2023
Undetected for: 5 daysoccurrence → discovery
Materiality determined: Dec 20, 2023
Notification sent: Dec 20, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Launched an investigation, with the assistance of third-party forensic specialists
Undertook a comprehensive and time-intensive review of the contents of the email accounts
Enhanced our existing security protocols
Evaluating our policies and procedures related to data privacy and security
Offering you access to [Extra4] months of complimentary credit monitoring and identity protection services through Experian
Changes made: Enhanced our existing security protocols
Evaluating our policies and procedures related to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(106 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Montana State AGDec 20 · first

Maine State AGDec 20 · first

Massachusetts State AGDec 20 · first

Vermont State AGDec 20 · first · this page

New Hampshire State AG+56d

Maine State AG+56d

Pattern: first filing Dec 20 (MT), last Feb 14 (ME) — a 56-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-12-20-cumberland-advisors-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 20, 2023
Raw hash: d99b8e2a5184def99d0a704b450fd1cfe10d9c2a9ccdc6889c17ad43426e2aba

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCumberland Advisors, LLC

Victim entityCumberland Advisors, LLC

Incidentdiscovered Sep 5, 2023

Stated responseLaunched an investigation, with the assistance of third-party forensic specialists

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov