HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

Conrad Capital Management, Inc.

bd_728ec9cfa01e98dd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 8, 2026

Filed

May 20, 2026

To disclose

—

Affected

1state residents only

Linked

6 filings

Confidence

66%

Full breach record for Conrad Capital Management, Inc. →

Conrad Capital Management, Inc. disclosed a cybersecurity incident in Nebraska where an unauthorized person accessed its network between November 11, 2025, and March 8, 2026. The breach affected one Nebraska resident, whose name and Social Security number were copied. Conrad discovered the activity on March 8, 2026, and mailed notification on May 20, 2026, offering one year of credit monitoring through Kroll.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

Incident timeline

undetected · 117 days

Nov 11, 2025

Begins

Mar 8, 2026

Discovered

May 20, 2026

Filed

This filing is one of 6 about the same incident.View merged incident

A leak claim by dragonforce about this victim predates this filing by 62 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitedragonforcebd_c65ddffae291b78e2026-03-18 · +62dVerified

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_eea7ae16866245f72026-05-20Verified
Massachusetts State AGbd_2421d01920c97c2b2026-04-15 · +35dVerified by operator
Maine State AGbd_60b96fdbb36e7bd92026-04-15 · +35dVerified
Indiana State AGbd_d9f347e8c099123b2026-04-15 · +35dVerified

Name: Conrad Capital Management, Inc.
norm: conrad capital management
Domain: conradcapital.com

Name: Conrad Capital Management, Inc.
norm: conrad capital management
Domain: conradcapital.com
Industry: Financial Servicesllm

Discovered: Mar 8, 2026
Breach occurred: Nov 11, 2025 – Mar 8, 2026
Undetected for: 117 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 20, 2026
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified law enforcement and will cooperate with an investigation
Initial access: valid_credentials

During the incident: Took steps to secure their network
Commenced an investigation
Reviewed the files involved
Mailed a notification letter to the 1 Nebraska resident via United States Postal Service First-Class mail
Offering the residents one year of complimentary credit monitoring, fraud consultation, and identity theft restoration services through Kroll
Established a dedicated, toll-free call center
Notified law enforcement and will cooperate with an investigation
Changes made: Reviewing their safeguards and the security of their systems to help prevent a similar incident in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Massachusetts State AGApr 15 · first

Maine State AGApr 15 · first

Indiana State AGApr 15 · first

Maine State AG+35d

Nebraska State AG+35d · this page

Pattern: first filing Apr 15 (MA), last May 20 (NE) — a 35-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/37ddbb42-af88-4dec-a369-3398fe09e662.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 20, 2026
Raw hash: 1943da6f5960f60b1dfecfef38c27422068bcdab59492c5f1d8e175bf3e2970a

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityConrad Capital Management, Inc.

Victim entityConrad Capital Management, Inc.

Incidentdiscovered Mar 8, 2026

Stated responseTook steps to secure their network

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancenebraska.gov