HackingFinancial ServicesFinanceVulnerability ExploitData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)LowContained

ON Q FINANCIAL, LLC

bd_a5faead4f3404bf8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 20, 2024

Filed

Apr 3, 2024

To disclose

20 days

Affected

87state residents only

Linked

14 filings

Confidence

66%

Full breach record for ON Q FINANCIAL, LLC →2 incidents on file

On Q Financial, LLC notified the New Hampshire Attorney General of a data security incident involving the ConnectWise ScreenConnect vulnerability. The breach allowed an unknown actor to access the network and exfiltrate client personal information. 87 New Hampshire residents were notified on March 29, 2024. The company patched the vulnerability, engaged forensic investigators, and reported the incident to the FBI.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d20 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 6 weeks / 43 days

Feb 20, 2024

Begins

Feb 20, 2024

Discovered

Apr 3, 2024

Filed

vs. sector median

6 wks faster

This filing is one of 14 about the same incident.View merged incident

A leak claim by bianlian about this victim predates this filing by 43 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitebianlianbd_ee592bde892a7b022024-04-06 · +3dVerified by operator

Regulatory filings (9) · sorted by filing gap

South Carolina State AGbd_5fb90898a6e95a8e2024-04-03Verified
Massachusetts State AGbd_d4ea7af3e6261a2d2024-04-03Verified
Washington State AGbd_32dae1ae6ad3e6f42024-04-02 · +1dCandidate
California State AGbd_47866e35155e8f932024-04-02 · +1dVerified by operator

Show 5 more filings ↓up to 8d gap

Maine State AGbd_70331c336a1897252024-04-02 · +1dVerified by operator
Montana State AGbd_bfba92634c81bbdc2024-04-02 · +1dVerified by operator
Illinois State AGbd_bca121f6a23d98442024-04-01 · +2dVerified by operator
Indiana State AGbd_195d1d831b9193992024-03-29 · +5dVerified by operator
Oregon State AGbd_b11839235c04d95c2024-04-11 · +8dVerified

Showing first 10 of 13 linked disclosures.

Name: ON Q FINANCIAL, LLC
norm: on q financial
Domain: onqfinancial.com

Name: ON Q FINANCIAL, LLC
norm: on q financial
Domain: onqfinancial.com
Industry: Financial Servicesllm

Discovered: Feb 20, 2024
Breach occurred: Feb 20, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 29, 2024
Affected individuals: 87state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Patched and upgraded the application
Engaged a computer forensics investigation firm
Reported the incident to the Federal Bureau of Investigation
Changes made: Offering individuals complimentary identity protection services
Credit monitoring and proactive fraud assistance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Indiana State AGMar 29 · first

Illinois State AG+3d

Washington State AG+4d

California State AG+4d

Maine State AG+4d

Montana State AG+4d

South Carolina State AG+5d

Massachusetts State AG+5d

New Hampshire State AG+5d · this page

Oregon State AG+13d

Pattern: first filing Mar 29 (IN), last Apr 11 (OR) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 13 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/on-q-financial-20240403.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 3, 2024
Raw hash: f9d83d8edef5541febdecbd3591829b7b5cbaa07fc56abd740909ea7bc7a0597

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityON Q FINANCIAL, LLC

Victim entityON Q FINANCIAL, LLC

Incidentdiscovered Feb 20, 2024

Stated responsePatched and upgraded the application

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov