HackingFinancial ServicesFinanceData ExfiltratedTargetedGovernment IDFinancial accountPIIMediumContained

Bolton Global Capital, Inc.

bd_74e6452a6320c043 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 8, 2021

Filed

Mar 10, 2022

To disclose

26 weeks

Affected

2state residents only

Linked

4 filings

Confidence

65%

Full breach record for Bolton Global Capital, Inc. →

Bolton Global Capital, Inc. notified Montana residents of a data breach where an unknown third party accessed systems from Aug 12 to Sep 9, 2021. Suspicious activity was detected on Sep 8, 2021. Customer data including SSNs, driver's license numbers, and bank account numbers were potentially accessed. The company engaged forensic experts, notified the FBI, and offered 12 months of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 27 days

discovery → filing · 26 weeks / 183 days

Aug 12, 2021

Begins

Sep 8, 2021

Discovered

Mar 10, 2022

Filed

vs. sector median

+17 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_10930098d9d5d1572022-03-10Candidate
Maine State AGbd_15e1eac90ad9c7202022-03-10Verified
Massachusetts State AGbd_022a2914c6876bf92022-03-11 · +1dVerified

Name: Bolton Global Capital, Inc.
norm: bolton global

Name: Bolton Global Capital, Inc.
norm: bolton global
Industry: Financial Servicesllm

Discovered: Sep 8, 2021
Breach occurred: Aug 12, 2021 – Sep 9, 2021
Undetected for: 27 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 10, 2022
Affected individuals: 2state-resident count only
Data types: Government IDFinancial accountPII
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: reported the incident to the Federal Bureau of Investigation

During the incident: Began containment, mitigation, and restoration efforts to terminate the activity and to secure its network, systems, and data
Retained independent cybersecurity experts to conduct a forensic investigation
Reported the incident to the Federal Bureau of Investigation
Offering 12 months of complimentary identity theft protection services through IDX
Changes made: Implemented additional security measures to further harden our digital environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(183 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGMar 10 · first

Maine State AGMar 10 · first

Montana State AGMar 10 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-259.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 10, 2022
Raw hash: d14a81ffe7e6fd2ee6340bf0598d3449d7f9af5914e8084db7a155e9ea80d120

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBolton Global Capital, Inc.

Victim entityBolton Global Capital, Inc.

Incidentdiscovered Sep 8, 2021

Stated responseBegan containment, mitigation, and restoration efforts to terminate the activity and to secure its network, systems, and data

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov