HackingFinancial ServicesFinanceVulnerability ExploitTargetedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

J.W. COLE FINANCIAL, INC.

bd_82dfc303055548b4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 4, 2024

Filed

Sep 18, 2024

To disclose

14 days

Affected · nationwide

1591 in this filing

Linked

3 filings

Confidence

65%

Full breach record for J.W. COLE FINANCIAL, INC. →8 incidents on file

J.W. Cole Financial, Inc. reported an external system breach (hacking) occurring on April 19, 2024, discovered on September 4, 2024. The incident affected 159 individuals, including 1 Maine resident. Compromised data included names, personal identifiers, and financial account numbers. The company notified affected individuals on September 13, 2024, and offered 12 months of credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 4, 2024 → Filed with AG Sep 18, 202414d ✓ ME AG ≤30d14 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 138 days

discovery → filing · 14 days

Apr 19, 2024

Begins

Sep 4, 2024

Discovered

Sep 18, 2024

Filed

vs. sector median

6 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_8e2c29b52dc9406b2024-09-19 · +1dVerified
New Hampshire State AGbd_bdad008d8634079b2024-12-12 · +85dVerified

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: J.W. COLE FINANCIAL, INC.
norm: jw cole financial
Industry: Financial Servicesllm

Discovered: Sep 4, 2024
Breach occurred: Apr 19, 2024
Undetected for: 138 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 13, 2024
Affected individuals: 159state + nationwide
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Offered 12 months of complimentary credit monitoring through Kroll Identity Monitoring
Changes made: Continually evaluate and modify practices to enhance security and privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: ME AG ≤30d · 14d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 4, 2024
→ Filed with AG: Sep 18, 2024
14d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 4, 2024 → Filed with AG: Sep 18, 2024	14d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGSep 18 · first · this page

Massachusetts State AG+1d

New Hampshire State AG+85d

Pattern: first filing Sep 18 (ME), last Dec 12 (NH) — a 85-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/d7a58005-e7bc-4334-b902-1e8843af84af.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 18, 2024
Raw hash: 1c187f42fc63e0bfbbc88ff68e6e2ddf966c0a9fc2665603d8a2a12c22a6c107

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityJ.W. COLE FINANCIAL, INC.

Incidentdiscovered Sep 4, 2024

Stated responseSent written notification to affected individuals

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov