HackingVulnerability ExploitCustomer Data InvolvedIDENTITY_BASICLowContained
CUSO Financial Services, L.P.
bd_7dfd4f2b42eb5c01 · schema v1 · pii pii-v1
Full breach record for CUSO Financial Services, L.P. →CUSO Financial Services, LP notified the California AG of an incident where an unauthorized party exploited a vulnerability in Barracuda Networks email application to access historical emails and attachments. The breach occurred on July 5, 2022, and was discovered on October 20, 2023. Affected data includes names and other personal information. The company closed the vulnerability, reported the incident to federal law enforcement, and offered credit monitoring services.
California clockDiscovered Oct 20, 2023 → Notified Feb 16, 2024119d ✗ CA 60-day late17 weeks discovery → filing
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-581125
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 16, 2024
- Raw hash
- 22b56396b7f4301035b206ab3f13d41b63e5277741336265b27cf709a6f1a0ea
Reporting entity
- Name
- CUSO Financial Services, L.P.norm: cuso financial
Victim entity
- Name
- CUSO Financial Services, L.P.norm: cuso financial
Incident
- Discovered
- Oct 20, 2023
- Materiality determined
- —
- Notification sent
- Feb 16, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1114 Email Collection
- Threat actor
- External
- Regulator citations
- Reported the event to federal law enforcement
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 17 weeks(119 days from discovery to filing)
- Compliance flags
- CA 60-day late · 119d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Oct 20, 2023→ Notified: Feb 16, 2024119d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.