HackingFinancial ServicesFinanceStolen CredentialsTargetedIdentity (basic)Government IDMediumContained

Stoneleigh Recovery Association, LLC

bd_7bf237ba19b2c41f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 19, 2018

Filed

Jul 20, 2018

To disclose

13 weeks

Affected

1state residents only

Confidence

64%

Full breach record for Stoneleigh Recovery Association, LLC →

Stoneleigh Recovery Association, LLC notified Montana residents of a data breach occurring on April 19, 2018. An unauthorized individual viewed personal information including SSNs, addresses, and emails. The company offered one year of credit monitoring via Experian and retrained staff.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 92 days

Apr 19, 2018

Begins

Apr 19, 2018

Discovered

Jul 20, 2018

Filed

vs. sector median

+5 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Stoneleigh Recovery Association, LLC
norm: stoneleigh recovery

Name: Stoneleigh Recovery Association, LLC
norm: stoneleigh recovery
Industry: Financial Servicesllm

Discovered: Apr 19, 2018
Breach occurred: Apr 19, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 23, 2018
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Filed notice with Montana Attorney General Office of Consumer Protection
Initial access: valid_credentials

During the incident: Offering credit report monitoring for one year at no cost through Experian’s IdentityWorksTM program
Retrained administrative staff to ensure policies and procedures are followed
Changes made: Retrained administrative staff to ensure policies and procedures are followed
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(92 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Stoneleigh-Recovery-Assoc..pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 20, 2018
Raw hash: d1a5b866d0d1d36d65bb33da6f2630eddb5362e7a11d8325e0a79f9c507018cf

Reporting entityStoneleigh Recovery Association, LLC

Victim entityStoneleigh Recovery Association, LLC

Incidentdiscovered Apr 19, 2018

Stated responseOffering credit report monitoring for one year at no cost through Experian’s IdentityWorksTM program

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov