HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountPHIHealth (basic)HighContained

Fidelity Investments

bd_78b327f683ac4935 · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 19, 2024

Filed

Oct 9, 2024

To disclose

7 weeks

Affected

2,731state residents only

Linked

10 filings

Confidence

71%

Full breach record for Fidelity Investments →99 incidents on file

Fidelity Investments reported that between August 17-19, 2024, an unauthorized party accessed an internal database using fraudulent customer accounts, retrieving documents containing PII, financial data, and PHI of 2,731 Washington residents. Fidelity detected the breach on August 19, terminated access, and began notifying affected individuals on October 9, 2024, offering two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d7 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 2 days

discovery → filing · 7 weeks / 51 days

Aug 17, 2024

Begins

Aug 19, 2024

Discovered

Oct 9, 2024

Filed

vs. sector median

1 wks faster

This filing is one of 10 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

California State AGbd_77897170293356c72024-10-09Candidate
Oregon State AGbd_b3720a09163c4a4f2024-10-09Verified
New Hampshire State AGbd_c1a61cf0020059522024-10-09Verified
Maine State AGbd_d2abb4008659b4252024-10-09Verified

Show 5 more filings ↓up to 8d gap

Indiana State AGbd_f24c35fc28546ae62024-10-09Verified
Montana State AGbd_fa30fee34b59e35f2024-10-09Verified
Massachusetts State AGbd_ffdfabe1fcd7f5182024-10-09Verified
South Carolina State AGbd_c77a4454e517e3292024-10-14 · +5dVerified
Illinois State AGbd_98e888bf9c01efa42024-10-01 · +8dVerified

Name: Fidelity Investments
norm: fidelity investments
Domain: fidelity.com

Name: Fidelity Investments
norm: fidelity investments
Domain: fidelity.com
Industry: Financial Servicesllm

Discovered: Aug 19, 2024
Breach occurred: Aug 17, 2024 – Aug 19, 2024
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 9, 2024
Affected individuals: 2,731state-resident count only
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthPassport numberHealth insurance IDMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General
Initial access: valid_credentials

During the incident: Disabled the two accounts used to make the requests and terminated the access
Launched an investigation with assistance from external security experts
Took remedial actions to prevent a recurrence of this type of activity
Began notifying these individuals via U.S. Mail
Established a toll-free call center for notified individuals
Offering each of these individuals two years of free credit monitoring and identity protection services from TransUnion
Changes made: Took remedial actions to prevent a recurrence of this type of activity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(51 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGOct 1 · first

California State AG+8d

Oregon State AG+8d

New Hampshire State AG+8d

Maine State AG+8d

Indiana State AG+8d

Montana State AG+8d

Massachusetts State AG+8d

Washington State AG+8d · this page

South Carolina State AG+13d

Pattern: first filing Oct 1 (IL), last Oct 14 (SC) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30947.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 9, 2024
Raw hash: 2ac21f7115d6f484af4de0a025a8b296b25eb7ed04bf8c63a71f3e0f72364da4

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityFidelity Investments

Victim entityFidelity Investments

Incidentdiscovered Aug 19, 2024

Stated responseDisabled the two accounts used to make the requests and terminated the access

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com