MalwareFinancial ServicesFinanceRansomwareData ExfiltratedRansom DemandedIdentity (basic)Government IDFinancial accountHighContained

Northwest Retirement Plan Consultants, LLC

bd_77c6b14202068b33 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 2, 2024

Filed

Feb 28, 2025

To disclose

26 weeks

Affected

1,821state residents only

Linked

3 filings

Confidence

69%

Full breach record for Northwest Retirement Plan Consultants, LLC →2 incidents on file

Northwest Retirement Plan Consultants, LLC reports a ransomware incident where an unauthorized individual acquired data on or around August 31, 2024. The breach affected 1,821 Washington residents, exposing names, DOBs, SSNs, and financial account info. NWRPC engaged forensic specialists, contained the incident, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d26 weeks discovery → filing

Incident timeline

undetected · 2 days

discovery → filing · 26 weeks / 179 days

Aug 31, 2024

Begins

Sep 2, 2024

Discovered

Feb 28, 2025

Filed

vs. sector median

+16 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_aab1333d9a5254d22025-02-28Verified
Maryland State AGbd_d2b761f23d6ea5772025-02-28Verified

Name: Cipriani & Werner
norm: cipriani werner
Domain: c-wlaw.com

Name: Northwest Retirement Plan Consultants, LLC
norm: northwest retirement plan consultants
Industry: Financial Servicesllm

Discovered: Sep 2, 2024
Breach occurred: Aug 31, 2024
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 28, 2025
Affected individuals: 1,821state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: NameSocial Security numberFinancial account numberDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General's Office
Initial access: valid_credentials

During the incident: Engaged third-party forensic specialists to contain the incident
Provided notification to identified individuals
Offered complimentary credit monitoring and identity protection services for 12 months
Changes made: Took steps to secure systems
Enhanced the security of the network to prevent similar incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(179 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGFeb 28 · first

Maryland State AGFeb 28 · first

Washington State AGFeb 28 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32538.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 28, 2025
Raw hash: 514196c86a0e5288250350893ef96df8d6f0785a5d1876dc3613689129c73e40

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCipriani & Werner

Victim entityNorthwest Retirement Plan Consultants, LLC

Incidentdiscovered Sep 2, 2024

Stated responseEngaged third-party forensic specialists to contain the incident

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com