HackingFinancial ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountHighContained

Unified Trust Company, N.A.

bd_b63082d9bea2b659 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 13, 2018

Filed

Nov 7, 2018

To disclose

38 weeks

Affected

1,196state residents only

Linked

6 filings

Confidence

69%

Full breach record for Unified Trust Company, N.A. →

Unified Trust Company, N.A. notified the Washington AG of unauthorized access to two employee email accounts between Dec 6, 2017 and Feb 25, 2018. Access was gained via phishing on Feb 13, 2018. 1,196 WA residents affected. Data included names, DOBs, SSNs, addresses, and some financial account numbers. UTC engaged forensic investigators, reset passwords, implemented MFA, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 69 days

discovery → filing · 38 weeks / 267 days

Dec 6, 2017

Begins

Feb 13, 2018

Discovered

Nov 7, 2018

Filed

vs. sector median

+30 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_42ed6c5382ac2c0c2018-11-07Verified
California State AGbd_a071eca79b11746c2018-11-07Verified
South Carolina State AGbd_4cb740f3d6c5b80a2018-11-13 · +6dVerified
New Hampshire State AGbd_8c021dae427df9fd2018-11-13 · +6dVerified

Show 1 more filing ↓up to 21d gap

California State AGbd_97a5dddf0eeca1692018-11-28 · +21dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Unified Trust Company, N.A.
norm: unified trust company na
Industry: Financial Servicesllm

Discovered: Feb 13, 2018
Breach occurred: Dec 6, 2017 – Feb 25, 2018
Undetected for: 69 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 7, 2018
Affected individuals: 1,196state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: NameSocial Security numberFinancial account numberDate of birth
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 200-299dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Reported this incident to, and has been cooperating with, their primary federal regulator, the Office for the Comptroller of the Currency (the “OCC”)Notifying other state regulators and the consumer reporting agencies
Initial access: phishing_link

During the incident: Launched an internal investigation, with the assistance of third-party forensic investigators
Ensuring that passwords for the affected email accounts were changed
Implemented multi-factor authentication
Provided additional training to users on how to identify phishing scams
Providing potentially affected individuals access to 12 months of credit monitoring and identity restoration services, through AllClear ID
Changes made: Implemented multi-factor authentication
Enhanced security procedures around client accounts
Provided additional training to users on how to identify phishing scams
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 38 weeks(267 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Massachusetts State AGNov 7 · first

California State AGNov 7 · first

Washington State AGNov 7 · first · this page

South Carolina State AG+6d

New Hampshire State AG+6d

California State AG+21d

Pattern: first filing Nov 7 (MA), last Nov 28 (CA) — a 21-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10589.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 7, 2018
Raw hash: a2c91b9bef2e3821f1f552ed564e8cf7b1f9a8f10dd73dce4353933d84690800

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityUnified Trust Company, N.A.

Incidentdiscovered Feb 13, 2018

Stated responseLaunched an internal investigation, with the assistance of third-party forensic investigators

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com