HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDHighContained

WESTERN UNION FINANCIAL SERVICES, INC.

bd_a1964b361ebe667a · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 1, 2016

Filed

Dec 20, 2016

To disclose

25 weeks

Affected

2,470state residents only

Linked

5 filings

Confidence

67%

Full breach record for WESTERN UNION FINANCIAL SERVICES, INC. →2 incidents on file

Western Union Financial Services notified Washington AG of unauthorized access to a vendor-supplied external storage system in July 2016. Approximately 2,470 Washington residents were affected. Data included driver's license, SSN, and DOB. Western Union notified law enforcement, engaged in investigation, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 25 weeks / 172 days

Jul 1, 2016

Begins

Jul 1, 2016

Discovered

Dec 20, 2016

Filed

vs. sector median

+15 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_0a57b3336e4226e32016-12-20Verified
Massachusetts State AGbd_8f47d111e2382a992016-12-20Verified
Montana State AGbd_a4dfa4d88a61c5512016-12-20Verified
Oregon State AGbd_99664afabdc078002016-12-27 · +7dVerified

Name: WESTERN UNION FINANCIAL SERVICES, INC.
norm: western union financial
Industry: Finance

Name: WESTERN UNION FINANCIAL SERVICES, INC.
norm: western union financial
Industry: Finance
Industry: Financial Servicesllm

Discovered: Jul 1, 2016
Breach occurred: Jul 1, 2016 – Jul 31, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 20, 2016
Affected individuals: 2,470state-resident count only
Data types: Identity (basic)Government ID
Data elements: Date of birthDriver's licence numberSocial Security numberName
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Attorney General Bob FergusonNotified Director of Consumer Services at Washington Department of Financial Institutions
Initial access: supply_chain

During the incident: Promptly informed federal law enforcement
Actively cooperating with law enforcement's investigation
Conducted investigation to analyze the data on the external storage system
Providing individualized notification to each Washington resident
Offering complimentary one-year membership in Experian's ProtectMyID product
Changes made: The external system is no longer in use
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(172 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGDec 20 · first

Massachusetts State AGDec 20 · first

Montana State AGDec 20 · first

Washington State AGDec 20 · first · this page

Oregon State AG+7d

Pattern: first filing Dec 20 (CA), last Dec 27 (OR) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9659.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 20, 2016
Raw hash: f331d33663d5f3174272bb0578ca7ffdc83494d430234bfadfd1394f34aad7ec

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWESTERN UNION FINANCIAL SERVICES, INC.

Victim entityWESTERN UNION FINANCIAL SERVICES, INC.

Incidentdiscovered Jul 1, 2016

Stated responsePromptly informed federal law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com