HackingFinancial ServicesFinanceStolen CredentialsData MishandlingSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Financial accountLowContained

WESTERN UNION FINANCIAL SERVICES, INC.

bd_8fc621545c740b56 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 23, 2021

Filed

Mar 17, 2021

To disclose

8 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

64%

Full breach record for WESTERN UNION FINANCIAL SERVICES, INC. →2 incidents on file

Western Union Financial Services, Inc. notified customers that their personal information may have been accessed due to a compromise of Accellion, a file transfer service provider used by Kroger. The unauthorized access occurred between December 24-29, 2020, and was discovered by Kroger on January 23, 2021. Western Union's own systems were not directly compromised. The incident involved data related to money transfers initiated or paid out at Kroger retail locations. Western Union is offering two years of complimentary Experian Identity Works to affected customers.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 23, 2021 → Notified Mar 17, 202153d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 30 days

discovery → filing · 8 weeks / 53 days

Dec 24, 2020

Begins

Jan 23, 2021

Discovered

Mar 17, 2021

Filed

vs. sector median

2 wks faster

This filing is one of 5 filings about the same incident.View merged incident

Part of Accellion supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_1fab2410dc395ac12021-03-17Verified
Indiana State AGbd_9f187e4a92022af12021-03-17Verified
Maine State AGbd_fa64d47849f6b1192021-03-17Candidate
New Hampshire State AGbd_076b587840f1845e2021-03-18 · +1dVerified

Name: WESTERN UNION FINANCIAL SERVICES, INC.
norm: western union financial

Name: WESTERN UNION FINANCIAL SERVICES, INC.
norm: western union financial
Industry: Financial Servicesllm

Discovered: Jan 23, 2021
Breach occurred: Dec 24, 2020 – Dec 29, 2020
Undetected for: 30 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 17, 2021
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: External
Initial access: supply_chain

During the incident: Immediately began investigating to determine what personal information handled by Kroger was affected
Confirmed that Kroger stopped using the affected file transfer service provided by Accellion
Offering complimentary access to Experian Identity Works for a period of two years
Changes made: Reviewing Kroger’s security practices
Monitoring the circumstances surrounding this event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: CA 60-day OK · 53d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 23, 2021
→ Notified: Mar 17, 2021
53d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 23, 2021 → Notified: Mar 17, 2021	53d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGMar 17 · first

Indiana State AGMar 17 · first

Maine State AGMar 17 · first

California State AGMar 17 · first · this page

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-539192
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 17, 2021
Raw hash: 75ae206054f68066477594ddebf0568b5e7885d673e2c348679daad0638287e0

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWESTERN UNION FINANCIAL SERVICES, INC.

Victim entityWESTERN UNION FINANCIAL SERVICES, INC.

Incidentdiscovered Jan 23, 2021

Stated responseImmediately began investigating to determine what personal information handled by Kroger was affected

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov