Social EngineeringPhishingStolen CredentialsDelayed DiscoveryIDENTITY_BASICCREDENTIALSLowContained
Capital Formation Group, Inc.
bd_868d9b732566467c · schema v1 · pii pii-v1
Full breach record for Capital Formation Group, Inc. →Capital Formation Group notified consumers of a data breach involving unauthorized access to an employee email account between Feb 8-14, 2023. The incident likely exposed names and contact information. The company reported the incident to law enforcement and offered 24 months of credit monitoring via Experian. Notification was sent July 27, 2023.
Vermont clock✗ VT AG >45 bday23 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_fa31d69264901398New Hampshire State AGfiled 2023-07-27Verified
- bd_27c0533575d915b6New Hampshire State AGfiled 2023-08-23(27d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-07-27-capital-formation-group-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 27, 2023
- Raw hash
- f7f258047da644de5e4307b7d06e44052cc3f60943bba5d7a819e806d3202cc6
Reporting entity
- Name
- Capital Onenorm: capital one
- Domain
- capitalone.com
Victim entity
- Name
- Capital Formation Group, Inc.norm: capital formation
- Domain
- capformgroup.com
Incident
- Discovered
- Feb 14, 2023
- Materiality determined
- —
- Notification sent
- Jul 27, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICCREDENTIALS
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- reported the event to law enforcement
- Initial access
- phishing_link
Compliance
- Time to disclose
- 23 weeks(163 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.