HackingVulnerability ExploitStolen CredentialsDelayed DiscoveryTargetedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIALMediumActive
Fora Financial
bd_9dbbd38a4ffe9c5f · schema v1 · pii pii-v1
Full breach record for Fora Financial →Fora Financial LLC notified consumers of a data breach where unauthorized third parties exploited a vulnerability in its information systems to obtain deal-related information, including personal data (name, DOB, SSN) and business financial information. The incident was discovered on September 9, 2022, and the source of compromise was terminated on February 19, 2023. Fora Financial is offering 12 months of identity monitoring services.
Vermont clock✗ VT AG >45 bday29 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_05be91cc7db2be26Montana State AGfiled 2023-03-29Candidate
- bd_53764b747a252fffNew Hampshire State AGfiled 2023-03-29Verified
- bd_e6e0434f0c22e8fcMaine State AGfiled 2023-03-29Verified by operator
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-03-29-fora-financial-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 29, 2023
- Raw hash
- 9958bd3bcc4e7a6cabea271c98bfa4ede63113f494d8cc2aa468dcfa7534e779
Reporting entity
- Name
- Fora Financialnorm: fora financial
- Domain
- forafinancial.com
Victim entity
- Name
- Fora Financialnorm: fora financial
- Domain
- forafinancial.com
Incident
- Discovered
- Sep 9, 2022
- Materiality determined
- Mar 29, 2023
- Notification sent
- Mar 29, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- ExternalSecondary
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 29 weeks(201 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.