Social EngineeringFinancial ServicesTechnologyFinancePhishingStolen CredentialsCustomer Data InvolvedDelayed DiscoveryPIIIdentity (basic)CredentialsLowContained

AMCP Payments Intermediate Company, LLC

bd_92576913cfdd372d · schema v1 · pii pii-v1

Severity

Low

Discovered

May 16, 2023

Filed

Dec 14, 2023

To disclose

30 weeks

Affected

13state residents only

Linked

5 filings

Confidence

64%

Full breach record for AMCP Payments Intermediate Company, LLC →2 incidents on file

AMCP Payments Intermediate Company LLC d/b/a Talus Pay notified individuals of a security incident where unauthorized actors accessed employee email accounts between May 2 and May 16, 2023. The breach potentially exposed personal information stored in those emails. Talus Pay secured its email tenant, launched an investigation, and is offering 12 months of credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 14 days

discovery → filing · 30 weeks / 212 days

May 2, 2023

Begins

May 16, 2023

Discovered

Dec 14, 2023

Filed

vs. sector median

+22 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_1910d29f36b809e32023-12-14Candidate
California State AGbd_755ff4a99a00cc092023-12-14Verified
Oregon State AGbd_986f88fa61f529882023-12-14Verified by operator
New Hampshire State AGbd_faf67977a41386752023-12-14Verified

Name: AMCP Payments Intermediate Company, LLC
norm: amcp payments intermediate

Name: AMCP Payments Intermediate Company, LLC
norm: amcp payments intermediate
Also named: AMCP Payments Intermediate Company LLCdba oflegal entity
Talus Paydba oftrade name
Industry: Financial ServicesllmTechnologyllm

Discovered: May 16, 2023
Breach occurred: May 2, 2023 – May 16, 2023
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 14, 2023
Affected individuals: 13state-resident count only
Data types: PIIIdentity (basic)Credentials
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: notified state regulators
Initial access: phishing_link

During the incident: Immediately took steps to secure our email tenant
Launched an investigation to determine the nature and scope of the incident
Notified state regulators
Offering access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance through Identity Force
Changes made: Working to implement additional security measures to further protect against similar incidents in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(212 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGDec 14 · first

California State AGDec 14 · first

Oregon State AGDec 14 · first

New Hampshire State AGDec 14 · first

Montana State AGDec 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-947.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 14, 2023
Raw hash: 2ab1aa6bb5ad4b311c44d2996630b9d4170ddf24f1a1b83e57d78847ffc05967

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAMCP Payments Intermediate Company, LLC

Victim entityAMCP Payments Intermediate Company, LLC

Incidentdiscovered May 16, 2023

Stated responseImmediately took steps to secure our email tenant

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov