HackingFinancial ServicesTechnologyFinanceStolen CredentialsTargetedGovernment IDIdentity (basic)CredentialsMediumContained

Envestnet, Inc.

bd_aad8a896da9a94f6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 4, 2020

Filed

Mar 17, 2021

To disclose

32 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for Envestnet, Inc. →2 incidents on file

Envestnet Financial Technologies notified Montana residents of a data breach affecting email platform accounts. Unauthorized access occurred on August 4, 2020, potentially exposing SSNs, passport numbers, driver's licenses, and credentials. The company engaged Kroll for two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 32 weeks / 225 days

Aug 4, 2020

Discovered

Mar 17, 2021

Filed

vs. sector median

+23 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_e73cca8bba39a3052020-12-23 · +84dVerified
New Hampshire State AGbd_f5320232e551bd8b2020-12-18 · +89dCandidate

Name: Envestnet, Inc.
norm: envestnet
Domain: envestnet.com

Name: Envestnet, Inc.
norm: envestnet
Domain: envestnet.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Aug 4, 2020
Materiality determined: —
Notification sent: Nov 1, 2020
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)Credentials
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Engaged a leading cybersecurity firm to assist in assessing the scope of the potential incident
Took steps to terminate the potential unauthorized access
Secured the services of Kroll to provide identity monitoring at no cost to you for two years
Changes made: Taking additional security steps to help prevent future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(225 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGDec 18 · first

Massachusetts State AG+5d

Montana State AG+89d · this page

Pattern: first filing Dec 18 (NH), last Mar 17 (MT) — a 89-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/evest-notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 17, 2021
Raw hash: bdb83af4e307df915bd26b1343d1d5ed6e9015f83376f9b572be1c8d0285b437

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityEnvestnet, Inc.

Victim entityEnvestnet, Inc.

Incidentdiscovered Aug 4, 2020

Stated responseEngaged a leading cybersecurity firm to assist in assessing the scope of the potential incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov