HackingFinancial ServicesFinanceSQL InjectionStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryFinancial accountIdentity (basic)Government IDPIICriticalContained

Catholic United Financial

bd_8e14bc0185707723 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Sep 6, 2017

Filed

Oct 6, 2017

To disclose

4 weeks

Affected · nationwide

127,310704 in this filing

Linked

6 filings

Confidence

69%

Full breach record for Catholic United Financial →

Catholic United Financial reported a SQL injection attack on its web server. Unauthorized access occurred between November 12, 2016, and August 28, 2017. The company discovered suspicious activity on September 6, 2017. Approximately 127,310 members nationwide had their PII (including SSNs) accessed. 704 Washington residents were affected. The company engaged forensic investigators, notified law enforcement/FBI, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 298 days

discovery → filing · 4 weeks / 30 days

Nov 12, 2016

Begins

Sep 6, 2017

Discovered

Oct 6, 2017

Filed

vs. sector median

5 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_095ea08906d84f192017-10-06Verified
Montana State AGbd_163b0a2490838b832017-10-06Candidate
New Hampshire State AGbd_444411c792158acf2017-10-05 · +1dVerified
Massachusetts State AGbd_d98cc38a86f2cabd2017-10-12 · +6dVerified

Show 1 more filing ↓up to 7d gap

Oregon State AGbd_a56592d36390de292017-10-13 · +7dVerified by operator

Name: Stinson Leonard Street LLP
norm: stinson leonard street

Name: Catholic United Financial
norm: catholic united financial
Industry: Financial Servicesllm

Discovered: Sep 6, 2017
Breach occurred: Nov 12, 2016 – Aug 28, 2017
Undetected for: 298 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 6, 2017
Affected individuals: 127,310state + nationwide
Data types: Identity (basic)Government IDPII
Data elements: NameSocial Security numberFinancial account numberDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified local law enforcementNotified the FBINotified Ramsey County, Minnesota sheriff
Initial access: exploit_public_facing

During the incident: Hired outside forensic investigators to assess the situation
Removed all potential access to personally identifiable information on its web server
Secured the web server from any possible further attack
Notified local law enforcement as well as the FBI
Cooperating in their investigations
Providing written notification to all of its members
Offering 24 months of credit monitoring, fraud consultation, and identity theft restoration through Kroll
Changes made: Hardening its security with the help of outside experts
Restoring website with even-more enhanced security measures and programming
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGOct 5 · first

California State AG+1d

Montana State AG+1d

Washington State AG+1d · this page

Massachusetts State AG+7d

Oregon State AG+8d

Pattern: first filing Oct 5 (NH), last Oct 13 (OR) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9742.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 6, 2017
Raw hash: f028935eecef7a766481aeacb09d9bf86055f071ee8259dde057af17910f6b0d

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityStinson Leonard Street LLP

Victim entityCatholic United Financial

Incidentdiscovered Sep 6, 2017

Stated responseHired outside forensic investigators to assess the situation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com