Social EngineeringFinancial ServicesProfessional ServicesFinancePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Lakeland Finance, LLC

bd_a99072d429819693 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 14, 2019

Filed

Apr 16, 2019

To disclose

5 weeks

Affected · nationwide

5351 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Lakeland Finance, LLC →

Lakeland Finance, LLC dba WorldStrides notified the NH AG of a phishing attack (Oct-Nov 2018) discovered March 14, 2019. Attackers accessed employee email accounts, potentially exposing PII (SSN, DL, financial, health data) of 535 individuals (1 NH resident). Response included forensic investigation, FBI notification, and 1-year credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 150 days

discovery → filing · 5 weeks / 33 days

Oct 15, 2018

Begins

Mar 14, 2019

Discovered

Apr 16, 2019

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_fedb233651757fbd2019-04-16Verified

Name: Jackson Lewis
norm: jackson lewis
Domain: jacksonlewis.com

Name: Lakeland Finance, LLC
norm: lakeland finance
Also named: Lakeland Finance, LLCdba oflegal entity
WorldStridesdba oftrade name
Industry: Financial ServicesllmProfessional Servicesllm

Discovered: Mar 14, 2019
Breach occurred: Oct 15, 2018 – Nov 21, 2018
Undetected for: 150 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 17, 2019
Affected individuals: 535state + nationwide
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the New Hampshire Office of the Attorney GeneralReported this incident to the Federal Bureau of Investigation ("FBI")
Initial access: phishing_link

During the incident: Commenced an investigation to determine the scope of this incident
Worked with its information technology team to secure and scan its systems for malicious activity
Retained a third party forensic vendor to determine what information may have been accessed
Engaged a firm to perform data mining on each of the impacted email accounts
Reported this incident to the Federal Bureau of Investigation ("FBI")
Arranged for one year of free credit monitoring service
Changes made: Reexamining its current privacy and data security policies and procedures
Reviewing its technical security policies and procedures and making improvements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(33 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGApr 16 · first

New Hampshire State AGApr 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/lakeland-finance-20190416.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 16, 2019
Raw hash: e3a572b93e30abc82dddc68623af9acb8a030ac8439e4fac2d56a54edd6b11c3

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityJackson Lewis

Victim entityLakeland Finance, LLC

Incidentdiscovered Mar 14, 2019

Stated responseCommenced an investigation to determine the scope of this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov