MalwareFinancial ServicesFinanceRansomwareData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Janney Montgomery Scott LLC

bd_7164966a2acef87b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 1, 2022

Filed

May 2, 2022

To disclose

4 weeks

Affected

119state residents only

Linked

5 filings

Confidence

66%

Full breach record for Janney Montgomery Scott LLC →

Janney Montgomery Scott LLC notified the NH AG of a ransomware attack on third-party vendor R.R. Donnelley & Sons Company. The incident, detected on April 1, 2022, exposed PII (name, DOB, address, SSN) and financial account data of 119 NH residents. Janney engaged counsel, reviewed data, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 99 days

discovery → filing · 4 weeks / 31 days

Dec 23, 2021

Begins

Apr 1, 2022

Discovered

May 2, 2022

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

Part of R. R. DONNELLEY & SONS COMPANY supply-chain incident (2022) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_08df3ab97507398a2022-04-29 · +3dVerified
Massachusetts State AGbd_7098cd3cfe4361f82022-04-29 · +3dVerified
Maine State AGbd_a046ce59a2ee361d2022-04-29 · +3dVerified
Montana State AGbd_590c157e5f503fe52022-04-28 · +4dCandidate

Name: Janney Montgomery Scott LLC
norm: janney montgomery scott

Name: Janney Montgomery Scott LLC
norm: janney montgomery scott
Industry: Financial Servicesllm

Discovered: Apr 1, 2022
Breach occurred: Dec 23, 2021
Undetected for: 99 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 29, 2022
Affected individuals: 119state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney GeneralProvided notice to New Hampshire Banking Department
Initial access: supply_chain

During the incident: Launched an investigation
Engaged legal counsel with an expertise in cybersecurity
Began a comprehensive and thorough review of the data
Worked with RRD to understand which client accounts had been impacted
Conducted an internal review of the accounts
Actively monitor the security of its systems and client accounts
Changes made: Working with RRD to mitigate and remediate the incident
Investing in internal processes, tools, and resources to reduce the likelihood that this could happen again
Offering complimentary identity protection/credit monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGApr 28 · first

Indiana State AG+1d

Massachusetts State AG+1d

Maine State AG+1d

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/janney-montgomery-scott-20220502.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 2, 2022
Raw hash: 262c081f4605b346711201405914dabe27134c9520fafde511ac31165ef40fc7

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityJanney Montgomery Scott LLC

Victim entityJanney Montgomery Scott LLC

Incidentdiscovered Apr 1, 2022

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov