HackingVulnerability ExploitData ExfiltratedCustomer Data InvolvedPIIIDENTITY_BASICLowContained
ON Q FINANCIAL, LLC
bd_a5faead4f3404bf8 · schema v1 · pii pii-v1
Full breach record for ON Q FINANCIAL, LLC →On Q Financial, LLC notified the New Hampshire Attorney General of a data security incident involving the ConnectWise ScreenConnect vulnerability. The breach allowed an unknown actor to access the network and exfiltrate client personal information. 87 New Hampshire residents were notified on March 29, 2024. The company patched the vulnerability, engaged forensic investigators, and reported the incident to the FBI.
Leak gap clock⏱ Leak >30d20 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
A leak claim by bianlian about this victim predates this filing by 43 days.View originating leak claim
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_47866e35155e8f93California State AGfiled 2024-04-02(1d gap)Candidate
- bd_70331c336a189725Maine State AGfiled 2024-04-02(1d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/on-q-financial-20240403.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 3, 2024
- Raw hash
- f9d83d8edef5541febdecbd3591829b7b5cbaa07fc56abd740909ea7bc7a0597
Reporting entity
- Name
- ON Q FINANCIAL, LLCnorm: on q financial
- Domain
- onqfinancial.com
Victim entity
- Name
- ON Q FINANCIAL, LLCnorm: on q financial
- Domain
- onqfinancial.com
Incident
- Discovered
- Mar 14, 2024
- Materiality determined
- —
- Notification sent
- Mar 29, 2024
- Affected individuals
- 87
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified New Hampshire Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 20 days(20 days from discovery to filing)
- Compliance flags
- Leak >30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.