DisclosureLens
HackingFinancial ServicesFinanceVulnerability ExploitPIIGovernment IDHighContained

CUSO Financial Services, L.P.

bd_9c6021565739f156 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 1, 2024

Filed

Feb 16, 2024

To disclose

15 days

Affected · nationwide

25,6987 in this filing

Linked

7 filings

Confidence

50%
Full breach record for CUSO Financial Services, L.P. →5 incidents on file

CUSO Financial Services, LP reported a data breach affecting 7 Maine residents as a result of a vulnerability in their Barracuda Message Archiver. The breach, which occurred on July 5, 2022 and was discovered on February 1, 2024, resulted in the compromise of names and Social Security numbers. The company began notifying affected individuals on February 16, 2024 and offered them 12 months of credit monitoring and identity theft services.

Maine clockDiscovered Feb 1, 2024 → Filed with AG Feb 16, 202415d ✓ ME AG ≤30d15 days discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 576 days
discovery → filing · 15 days

Jul 5, 2022

Begins

Feb 1, 2024

Discovered

Feb 16, 2024

Filed

vs. sector median

6 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Show 2 more filings ↓

Filing propagation · 7 filings · 7 states

View merged incident ↗
Massachusetts State AGFeb 16 · first
Vermont State AGFeb 16 · first
Indiana State AGFeb 16 · first
California State AGFeb 16 · first
Montana State AGFeb 16 · first
New Hampshire State AGFeb 16 · first
Maine State AGFeb 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.