HackingFinancial ServicesFinanceStolen CredentialsDelayed DiscoveryIdentity (basic)Government IDMediumContained

The Credit Pros

bd_7b0bf5b6df6c399c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 30, 2020

Filed

Jul 30, 2020

To disclose

4 weeks

Affected

18state residents only

Linked

5 filings

Confidence

65%

Full breach record for The Credit Pros →2 incidents on file

The Credit Pros International Corporation notified Montana residents of unauthorized access to an online storage service used for client documents. Access occurred between July 2016 and December 2019. The company discovered the breach in June 2020 after reviewing files accessed during the period. Affected data included names, addresses, SSNs, and driver's license numbers. The company engaged a security firm and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1452 days

discovery → filing · 4 weeks / 30 days

Jul 9, 2016

Begins

Jun 30, 2020

Discovered

Jul 30, 2020

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_2787c46ee206d1b82020-07-30Verified
California State AGbd_c13caac591aea8fd2020-07-30Verified
Massachusetts State AGbd_ce5c4e56185cb25b2020-07-30Verified
New Hampshire State AGbd_d21771425dff4f042020-07-31 · +1dVerified

Name: The Credit Pros
norm: the credit pros
Domain: thecreditpros.com

Name: The Credit Pros
norm: the credit pros
Domain: thecreditpros.com
Industry: Financial Servicesllm

Discovered: Jun 30, 2020
Breach occurred: Jul 9, 2016 – Dec 15, 2019
Undetected for: 1,452 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 20, 2020
Affected individuals: 18state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Changed the access settings for the service
A security firm was engaged
A thorough investigation was conducted
Arranged for you to receive a complimentary one-year membership to Experian’s® IdentityWorksSM credit monitoring service
Changes made: Changed the access settings for the service
Take steps to improve our data security and prevent future issues
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJul 30 · first

California State AGJul 30 · first

Massachusetts State AGJul 30 · first

Montana State AGJul 30 · first · this page

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/The-Credit-Pros-Consumer-ltr.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 30, 2020
Raw hash: 1d7069825e3259a63624b359c0911ec26ebfe1fd42e5654da8625a02e2f73b3a

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityThe Credit Pros

Victim entityThe Credit Pros

Incidentdiscovered Jun 30, 2020

Stated responseChanged the access settings for the service

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov