HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountHighContained

Movement Mortgage LLC

bd_84611419ab4b36ef · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 1, 2018

Filed

Aug 31, 2018

To disclose

35 weeks

Affected

9,605state residents only

Linked

6 filings

Confidence

66%

Full breach record for Movement Mortgage LLC →4 incidents on file

Movement Mortgage LLC disclosed unauthorized access to employee email accounts between October 9, 2017, and March 29, 2018. The incident involved the use of compromised credentials to send phishing emails and access personal information of loan applicants, including names, Social Security numbers, driver's license numbers, passport numbers, taxpayer ID numbers, credit card numbers, and bank account information. Approximately 9,605 California residents were affected. The company reset credentials, implemented MFA, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 1, 2018 → Notified Aug 31, 2018242d ✗ CA 60-day late35 weeks discovery → filing

Incident timeline

undetected · 84 days

discovery → filing · 35 weeks / 242 days

Oct 9, 2017

Begins

Jan 1, 2018

Discovered

Aug 31, 2018

Filed

vs. sector median

+26 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Oregon State AGbd_0728f76685a582862018-08-31Candidate
Montana State AGbd_c5db8dad3fdbc5762018-08-31Verified by operator
Massachusetts State AGbd_e19737bfce8739492018-08-31Verified
South Carolina State AGbd_506a3e8c608648672018-09-04 · +4dVerified

Show 1 more filing ↓up to 4d gap

New Hampshire State AGbd_6ff550f34d8ab1342018-09-04 · +4dVerified

Name: Movement Mortgage LLC
norm: movement mortgage

Name: Movement Mortgage LLC
norm: movement mortgage
Industry: Financial Servicesllm

Discovered: Jan 1, 2018
Breach occurred: Oct 9, 2017 – Mar 29, 2018
Undetected for: 84 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 31, 2018
Affected individuals: 9,605state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Providing notice to other state regulators
Initial access: valid_credentials

During the incident: Launched an investigation with the assistance of a third party forensic investigator
Reset email login credentials for all employee email accounts
Monitoring all email accounts for suspicious logins
Implemented multi-factor authentication on all email accounts
Offering affected individuals complimentary access to one year of free credit monitoring and identity restoration services through Experian
Changes made: Reviewing its existing information security procedures
Implementing additional training and education for employees
Increased their Information Technology security staff
Implementing additional system scanning and monitoring programs
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(242 days from discovery to filing)
Compliance flags: CA 60-day late · 242d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 1, 2018
→ Notified: Aug 31, 2018
242d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 1, 2018 → Notified: Aug 31, 2018	242d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Oregon State AGAug 31 · first

Montana State AGAug 31 · first

Massachusetts State AGAug 31 · first

California State AGAug 31 · first · this page

South Carolina State AG+4d

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-139484
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 31, 2018
Raw hash: 3615ea7d6c2d38e3babccbb16f66630bb2b3b9387248542c7fcc3de1d91984a5

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMovement Mortgage LLC

Victim entityMovement Mortgage LLC

Incidentdiscovered Jan 1, 2018

Stated responseLaunched an investigation with the assistance of a third party forensic investigator

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov