Social EngineeringTechnologyInformationPhishingStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

FORTRESS BIOTECH, INC.

bd_948608064db424e5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 25, 2021

Filed

Mar 18, 2022

To disclose

29 weeks

Affected

2state residents only

Linked

5 filings

Confidence

66%

Full breach record for FORTRESS BIOTECH, INC. →

Fortress Biotech, Inc. notified Montana residents of a phishing attack on an employee email account on August 25, 2021. The compromise potentially exposed names, DOBs, SSNs, driver's license numbers, and financial account data. The company reset credentials, enhanced security, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 29 weeks / 205 days

Aug 25, 2021

Begins

Aug 25, 2021

Discovered

Mar 18, 2022

Filed

vs. sector median

+11 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_4889cd869e4aeb902022-03-18Verified
New Hampshire State AGbd_5eb6da48e3a035d42022-03-18Verified
Maine State AGbd_a6731dd81ec0a41a2022-03-18Verified
Massachusetts State AGbd_637e62e5405fdb142022-03-23 · +5dVerified

Name: FORTRESS BIOTECH, INC.
norm: fortress biotech

Name: FORTRESS BIOTECH, INC.
norm: fortress biotech
Industry: Technologyllm

Discovered: Aug 25, 2021
Breach occurred: Aug 25, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Changed the compromised account’s password
Enhanced our security protocols
Investigated the activity in the account
Arranged to provide you with 24 months of complimentary credit monitoring
Changes made: Enhanced our security protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(205 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGMar 18 · first

New Hampshire State AGMar 18 · first

Maine State AGMar 18 · first

Montana State AGMar 18 · first · this page

Massachusetts State AG+5d

Pattern: first filing Mar 18 (IN), last Mar 23 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-272.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 18, 2022
Raw hash: 788d9a096a1ff59ba1a339a34d6d4c1747fdf232db651e5be9f713a490713a94

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityFORTRESS BIOTECH, INC.

Victim entityFORTRESS BIOTECH, INC.

Incidentdiscovered Aug 25, 2021

Stated responseChanged the compromised account’s password

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov