AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHighResolved

ON Q FINANCIAL, LLC

bd_9c7a401ee9e57ba7 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 24, 2021

Filed

Mar 22, 2021

To disclose

26 days

Affected

18,066state residents only

Linked

9 filings

Confidence

71%

Full breach record for ON Q FINANCIAL, LLC →2 incidents on file

On Q Financial, Inc. notified Washington AG of a data breach affecting 18,066 state residents. Between Feb 22-24, 2021, customer data (names, addresses, SSNs, financial info) was inadvertently transferred to a non-private data container. The breach was discovered on Feb 24, 2021. On Q secured the data, increased monitoring, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d26 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 2 days

discovery → filing · 26 days

Feb 22, 2021

Begins

Feb 24, 2021

Discovered

Mar 22, 2021

Filed

vs. sector median

6 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Delaware State AGbd_ea87f66e465145262021-04-01 · +10dVerified
Oregon State AGbd_1ae4d8fb85b70de52021-04-02 · +11dVerified
California State AGbd_8f5609e142fbcde82021-04-12 · +21dVerified
Montana State AGbd_b37844481daa41af2021-04-12 · +21dVerified

Show 4 more filings ↓up to 29d gap

Indiana State AGbd_9a0704f7989b37ef2021-04-18 · +27dVerified
South Carolina State AGbd_8668d38b81a294ec2021-04-19 · +28dVerified
Indiana State AGbd_9e2935e101eae70b2021-04-19 · +28dVerified
Massachusetts State AGbd_48fc9b7e467984e32021-04-20 · +29dVerified

Name: ON Q FINANCIAL, LLC
norm: on q financial
Domain: onqfinancial.com

Name: ON Q FINANCIAL, LLC
norm: on q financial
Domain: onqfinancial.com
Industry: Financial Servicesllm

Discovered: Feb 24, 2021
Breach occurred: Feb 22, 2021 – Feb 24, 2021
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 22, 2021
Affected individuals: 18,066state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: NameSocial Security number
WA-stated cause: Theft or Mistake
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Notified Washington State Office of the Attorney General

During the incident: Secured and restricted access to the data container and all potentially impacted customer data
Increased the monitoring of data transfers to help prevent similar incidents in the future
Offering you a credit monitoring service at no cost for 12 months through NortonLifeLock
Changes made: Increased the monitoring of data transfers to help prevent similar incidents in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 days(26 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 8 states

View merged incident ↗

Washington State AGMar 22 · first · this page

Delaware State AG+10d

Oregon State AG+11d

California State AG+21d

Montana State AG+21d

Indiana State AG+27d

South Carolina State AG+28d

Indiana State AG+28d

Massachusetts State AG+29d

Pattern: first filing Mar 22 (WA), last Apr 20 (MA) — a 29-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10433.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 22, 2021
Raw hash: 4d5d0f8dcba7b0c7efbc461ac7c69a78e731334cfb2c320d07b5b8e498acc771

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityON Q FINANCIAL, LLC

Victim entityON Q FINANCIAL, LLC

Incidentdiscovered Feb 24, 2021

Stated responseSecured and restricted access to the data container and all potentially impacted customer data

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com