HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)LowContained

Data Facts, Inc.

bd_a3de999be486f2ea · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 5, 2018

Filed

Dec 20, 2018

To disclose

6 weeks

Affected

6state residents only

Linked

2 filings

Confidence

66%

Full breach record for Data Facts, Inc. →

Data Facts, Inc. notified Montana residents that an employee email account was accessed by an unknown party on November 5, 2018. The account contained PII from background checks. Data Facts engaged forensic investigators, blocked access, and offered 12 months of credit monitoring. No evidence of data export was found.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 45 days

Nov 5, 2018

Discovered

Dec 20, 2018

Filed

vs. sector median

12 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_7a9d06c698d68b792019-01-28 · +39dVerified

Name: Data Facts, Inc.
norm: data facts

Name: Data Facts, Inc.
norm: data facts
Industry: Professional Servicesllm

Discovered: Nov 5, 2018
Materiality determined: —
Notification sent: Jan 31, 2019
Affected individuals: 6state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Took steps to block access to the account
Hired a leading forensics firm to help investigate
Changes made: Re-educating our employees on cyber best practices
Enhancing existing security measures by implementing two-factor authentication for remote email access
Offering 12 months of complimentary credit monitoring and identity theft protection services through AllClear ID
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGDec 20 · first · this page

New Hampshire State AG+39d

Pattern: first filing Dec 20 (MT), last Jan 28 (NH) — a 39-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Data-Facts-Inc.-Helena-Agri-Enterprise-LLC-Medaxion-O-R-Nurses-Credentialing-and-Orgill-1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 20, 2018
Raw hash: 6b66bc5a52c789306113593008612039b815650141e52a2fe689aaa36d40b7b0

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityData Facts, Inc.

Victim entityData Facts, Inc.

Incidentdiscovered Nov 5, 2018

Stated responseTook steps to block access to the account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov