HackingFinancial ServicesTechnologyFinanceStolen CredentialsTargetedCustomer Data InvolvedFinancial accountGovernment IDPIIMediumContained

Progrexion ASG, Inc.

bd_aecd5c3cdc8eb9f0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 8, 2021

Filed

Jun 8, 2021

To disclose

9 weeks

Affected

150state residents only

Linked

11 filings

Confidence

67%

Full breach record for Progrexion ASG, Inc. →2 incidents on file

Progrexion ASG, Inc. notified Washington AG that on April 8, 2021, a malicious third party used stolen consumer PII (SSN, DOB) to bypass authentication controls on its public-facing platforms. The actor accessed FICO scores, account numbers, and limited transaction data for 150 Washington residents. Progrexion took platforms offline, notified NCCIC, and offered 24 months of identity theft protection.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 9 weeks / 61 days

Apr 8, 2021

Discovered

Jun 8, 2021

Filed

vs. sector median

on median

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

South Carolina State AGbd_a8c9c7ce9849f6c92021-06-08Verified
Idaho State AGbd_dcc52e70a3f467042021-06-08Verified
New Hampshire State AGbd_238445988127ff192021-06-09 · +1dVerified
Massachusetts State AGbd_8521107b47f87e522021-06-09 · +1dVerified

Show 6 more filings ↓up to 34d gap

California State AGbd_c7acddbaaa1c8df22021-06-09 · +1dVerified
Delaware State AGbd_758cf1ceced1c3912021-06-16 · +8dVerified
Indiana State AGbd_ea321cd4e88250d92021-06-16 · +8dVerified
Oregon State AGbd_65824fe445e8ec0b2021-05-26 · +13dVerified
Idaho State AGbd_7917507aa07df9d62021-05-12 · +27dCandidate
Maine State AGbd_3c997f440ca227c42021-07-12 · +34dVerified

Name: Troutman Pepper Hamilton Sanders LLP
norm: troutman pepper hamilton sanders
Domain: troutman.com

Name: Progrexion ASG, Inc.
norm: progrexion asg
Industry: Financial ServicesllmTechnologyllm

Discovered: Apr 8, 2021
Materiality determined: —
Notification sent: Jun 16, 2021
Affected individuals: 150state-resident count only
Data types: Financial accountGovernment IDPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the National Cybersecurity Communications and Integration Center (NCCIC)
Initial access: valid_credentials

During the incident: Took the public-facing platforms offline
Notified the National Cybersecurity Communications and Integration Center (NCCIC) of the Incident
Arranged and are paying for a twenty-four (24) month membership in Trans Union's TrueIdentity theft protection services
Changes made: Evaluating its platforms to determine if additional controls should be implemented to reduce the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

Idaho State AGMay 12 · first

Oregon State AG+14d

South Carolina State AG+27d

Idaho State AG+27d

Washington State AG+27d · this page

New Hampshire State AG+28d

Massachusetts State AG+28d

California State AG+28d

Delaware State AG+35d

Indiana State AG+35d

Maine State AG+61d

Pattern: first filing May 12 (ID), last Jul 12 (ME) — a 61-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10481.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 8, 2021
Raw hash: b31a3fbe8eaf3835ce071b7f9377660b507245e448dded85704403252e69b060

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityTroutman Pepper Hamilton Sanders LLP

Victim entityProgrexion ASG, Inc.

Incidentdiscovered Apr 8, 2021

Stated responseTook the public-facing platforms offline

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com