HackingFinancial ServicesFinanceStolen CredentialsTargetedIdentity (basic)Government IDFinancial accountMediumContained

Novation Settlement Solutions

bd_ae137c6a3f1bfe87 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 1, 2016

Filed

Sep 23, 2016

To disclose

8 weeks

Affected

15state residents only

Linked

3 filings

Confidence

66%

Full breach record for Novation Settlement Solutions →

Novation Settlement Solutions notified Montana residents of a data incident in September 2016. In late August 2016, the company learned an unidentified third party possessed files containing names, DOBs, SSNs, addresses, and financial account numbers. Novation engaged Kroll for one year of identity monitoring and established a call center.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 53 days

Aug 1, 2016

Discovered

Sep 23, 2016

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_e3da30d5b96261012016-09-26 · +3dVerified
Massachusetts State AGbd_07d1bb630a227d9d2016-09-30 · +7dVerified

Name: Novation Settlement Solutions
norm: novation settlement

Name: Novation Settlement Solutions
norm: novation settlement
Industry: Financial Servicesllm

Discovered: Aug 1, 2016
Materiality determined: —
Notification sent: Sep 16, 2016
Affected individuals: 15state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the services of Kroll to provide identity monitoring at no cost to you for one year
Set up a customer call center to handle questions related to this incident
Changes made: Implement any additional security controls that are needed
Review and update privacy and security policies as appropriate
Ensure personnel are properly trained in information privacy and security practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGSep 23 · first · this page

California State AG+3d

Massachusetts State AG+7d

Pattern: first filing Sep 23 (MT), last Sep 30 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Novation-Settlement-Solutions.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 23, 2016
Raw hash: 8dbe7f4686f539f1bff581a11173945314936578e7aa9ce67a89a1ba717ec0ab

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNovation Settlement Solutions

Victim entityNovation Settlement Solutions

Incidentdiscovered Aug 1, 2016

Stated responseSecured the services of Kroll to provide identity monitoring at no cost to you for one year

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov