HackingFinanceCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountPIIMediumContained

CALTON & ASSOCIATES, INC.

bd_aeee1a1e6cfd8b06 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 26, 2025

To disclose

—

Affected

Not disclosed

Linked

9 records

Confidence

73%

Full breach record for CALTON & ASSOCIATES, INC. →

On March 28, 2025, Calton & Associates, Inc. experienced a network disruption during which unauthorized individuals accessed their network and exfiltrated certain files. Affected data included names, addresses, Social Security numbers, and account numbers. The company determined the scope on April 25, 2025, and sent notification letters on June 26, 2025. The FBI was notified. Cyberscout credit monitoring was offered to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Mar 28, 2025

Begins

Jun 26, 2025

Filed

This filing is one of 9 records about the same incident.View merged incident

A leak claim by cl0p about this victim was first seen 74 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_d41208bd0df5c4562025-04-13 · +73dVerified by operator

Regulatory filings (7) · sorted by filing gap

Montana State AGbd_15ff45acc8e418c62025-06-26Verified by operator
Massachusetts State AGbd_304579978ce6e1e82025-06-26Verified by operator
Nebraska State AGbd_5573d40fb788057a2025-06-26Verified by operator
Washington State AGbd_6c8c5bac0f4c2f972025-06-26Verified by operator

Show 3 more filings ↓up to 33d gap

Oregon State AGbd_d56e3cfbb0a0b9242025-06-30 · +4dVerified by operator
Illinois State AGbd_65c0b45d8c39dce52025-07-01 · +5dVerified
Massachusetts State AGbd_69979e8648007b882025-07-29 · +33dVerified by operator

Name: CALTON & ASSOCIATES, INC.
norm: calton associates
Domain: calton.com

Name: CALTON & ASSOCIATES, INC.
norm: calton associates
Domain: calton.com

Discovered: —
Breach occurred: Mar 28, 2025
Materiality determined: —
Notification sent: Jun 26, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated CollectionT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported the event to the FBI and are fully cooperating with their investigation

During the incident: Took immediate steps to ensure the unauthorized individuals no longer had access to our network
Reported the event to the FBI and are fully cooperating with their investigation
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge for 12 months through Cyberscout, a TransUnion company
Changes made: Implemented additional cybersecurity measures to enhance network security and minimize the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Montana State AGJun 26 · first

Massachusetts State AGJun 26 · first

Nebraska State AGJun 26 · first

Washington State AGJun 26 · first

California State AGJun 26 · first · this page

Oregon State AG+4d

Illinois State AG+5d

Massachusetts State AG+33d

Pattern: first filing Jun 26 (MT), last Jul 29 (MA) — a 33-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-604549
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 26, 2025
Raw hash: ec5d183fe50a67471df8a060dd447c995c2da6a537982b8becfaa311ed299c34

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entityCALTON & ASSOCIATES, INC.

Victim entityCALTON & ASSOCIATES, INC.

IncidentUnauthorized Access

Stated responseTook immediate steps to ensure the unauthorized individuals no longer had access to our network

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov