Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)CredentialsFinancial accountLowContained

A.B. Closing, Inc.

bd_b4da952fd54c74b6 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 26, 2020

Filed

Apr 24, 2020

To disclose

29 days

Affected

Not disclosed

Confidence

64%

Full breach record for A.B. Closing, Inc. →

A.B. Closing, Inc. D/B/A Kavaliro experienced a data breach involving unauthorized access to email and file sharing systems. The incident began with phishing emails using an imposter domain in March 2020, but investigation revealed unauthorized access to accounts dating back to September 2019. Affected data included names, dates of birth, phone numbers, email addresses, usernames, passwords, and financial account information. The company engaged forensic investigators, notified the FBI, enabled MFA, and offered identity monitoring services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 26, 2020 → Notified Apr 24, 202029d ✓ CA 60-day OK29 days discovery → filing

Incident timeline

undetected · 207 days

discovery → filing · 29 days

Sep 1, 2019

Begins

Mar 26, 2020

Discovered

Apr 24, 2020

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: A.B. Closing, Inc.
norm: ab closing

Name: A.B. Closing, Inc.
norm: ab closing
Also named: A.B. Closing, Inc.dba oflegal entity
Kavalirodba oftrade name
Industry: Financial Servicesllm

Discovered: Mar 26, 2020
Breach occurred: Sep 1, 2019 – Mar 29, 2020
Undetected for: 207 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 24, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)CredentialsFinancial account
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified the Federal Bureau of Investigation (FBI)
Initial access: phishing_link

During the incident: Initiated a comprehensive IT security investigation
Hired an independent forensic cybersecurity investigation firm to assist in its investigation and response
Notified the Federal Bureau of Investigation (FBI)
Enabled multi factor authentication on its business systems
Blocked certain foreign IP addresses
Conducted global password resets
Offering potentially impacted individuals one year of identity monitoring services at no cost through Kroll
Changes made: Working continually to harden its information security infrastructure and technological practices to better prevent any future unauthorized access to its information systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: CA 60-day OK · 29d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 26, 2020
→ Notified: Apr 24, 2020
29d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 26, 2020 → Notified: Apr 24, 2020	29d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-189446
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 24, 2020
Raw hash: 8afb94f634c7c08b30ad62baccf62084549cffed2a0a45c8295e77eea1c53ae4

Reporting entityA.B. Closing, Inc.

Victim entityA.B. Closing, Inc.

Incidentdiscovered Mar 26, 2020

Stated responseInitiated a comprehensive IT security investigation

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov