Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsEmployee Data InvolvedTargetedIdentity (basic)Government IDFinancialMediumContained

Cayan, LLC

bd_7d1de936620008f5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 14, 2017

Filed

Feb 23, 2017

To disclose

9 days

Affected

10state residents only

Linked

2 filings

Confidence

66%

Full breach record for Cayan, LLC →3 incidents on file

Cayan LLC reported a phishing incident on Feb 14, 2017, affecting 10 NH employees. Unauthorized access to 2016 W-2 forms occurred around Feb 9, 2017. Data exposed included names, addresses, SSNs, and wage info. Cayan notified the FBI, IRS, and state tax agencies, engaged third-party consultants, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 9 days

Feb 9, 2017

Begins

Feb 14, 2017

Discovered

Feb 23, 2017

Filed

vs. sector median

7 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_1a27aafb549453f72017-03-01 · +6dVerified

Name: Cayan, LLC
norm: cayan

Name: Cayan, LLC
norm: cayan
Industry: Financial Servicesllm

Discovered: Feb 14, 2017
Breach occurred: Feb 9, 2017
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 23, 2017
Affected individuals: 10state-resident count only
Data types: Identity (basic)Government IDFinancial
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the Federal Bureau of InvestigationNotified the Internal Revenue Service’s e-File Services DepartmentNotified the Criminal Investigation (IRS/CI) unitNotified state tax agencies
Initial access: phishing_link

During the incident: Reported to the Federal Bureau of Investigation and have pledged full support with its investigation
Notified the Internal Revenue Service’s e-File Services Department as well as the Criminal Investigation (IRS/CI) unit, and state tax agencies
Cooperating with the foregoing agencies
Initiated an internal investigation
Engaged third party consultants
Provided available technical details to aid in their investigation
Changes made: Reviewing potential enhancements to our internal security policies and procedures and employee training materials
Offering 12 months of credit monitoring and identity theft protection services through ID Experts®
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGFeb 23 · first · this page

Massachusetts State AG+6d

Pattern: first filing Feb 23 (NH), last Mar 1 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cayan-20170223.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 23, 2017
Raw hash: 0a091d5290028c5ff9ca13b37c0e4cfab3850025e1d9a6711b14c3f623a71773

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCayan, LLC

Victim entityCayan, LLC

Incidentdiscovered Feb 14, 2017

Stated responseReported to the Federal Bureau of Investigation and have pledged full support with its investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov