MalwareFinancial ServicesFinanceRansomwareStolen CredentialsData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedMulti-Stage ChainIdentity (basic)Government IDFinancial accountFinancial credentialsMediumContained

CITYWIDE HOME LOANS, LLC

bd_b6b664bb7002940c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 29, 2020

Filed

Mar 22, 2021

To disclose

16 weeks

Affected

54state residents only

Linked

11 filings

Confidence

66%

Full breach record for CITYWIDE HOME LOANS, LLC →

Citywide Home Loans, LLC submitted a supplemental notification to the New Hampshire Attorney General regarding a ransomware incident. The breach involved unauthorized access via stolen employee credentials through a VPN gateway on or about November 18, 2020. The attacker deployed ransomware, encrypting servers, and exfiltrated data (names, SSNs, financial info) to Mega cloud storage. 54 New Hampshire residents were identified as affected. Notifications began February 12, 2021. Citywide engaged forensic experts, law enforcement, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 11 days

discovery → filing · 16 weeks / 113 days

Nov 18, 2020

Begins

Nov 29, 2020

Discovered

Mar 22, 2021

Filed

vs. sector median

+7 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Maine State AGbd_bd7db8214abdd3ba2021-03-25 · +3dVerified
Washington State AGbd_6a666b75ee10fc922021-03-19 · +3dVerified
Oregon State AGbd_cabec362322632042021-03-19 · +3dVerified
Maine State AGbd_e8ea5bf83df4ef802021-03-19 · +3dVerified

Show 6 more filings ↓up to 80d gap

California State AGbd_5b65411c4f7f434c2021-02-16 · +34dVerified
Indiana State AGbd_386c31b538e6f36e2021-02-12 · +38dVerified
Montana State AGbd_d0e27bedc188f9fb2021-02-12 · +38dVerified
Maine State AGbd_2702f95acf3ad78e2021-02-11 · +39dCandidate
Massachusetts State AGbd_eff1d4dd668484382021-02-11 · +39dVerified
Illinois State AGbd_b2b84e4a4a13639a2021-01-01 · +80dVerified

Name: CITYWIDE HOME LOANS, LLC
norm: citywide home loans
Domain: citywidehomeloans.com

Name: CITYWIDE HOME LOANS, LLC
norm: citywide home loans
Domain: citywidehomeloans.com
Industry: Financial Servicesllm

Discovered: Nov 29, 2020
Breach occurred: Nov 18, 2020
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 12, 2021
Affected individuals: 54state-resident count only
Data types: Identity (basic)Government IDFinancial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: reported the incident to law enforcement
Initial access: valid_credentials

During the incident: Took a number of its systems offline as a precautionary measure
Engaged external cybersecurity experts to assist it in responding to the incident
Reported the incident to law enforcement
Contacting law enforcement and engaging third-party cybersecurity experts to assist us in remediating and ensuring the ongoing security of our systems
Changes made: Accelerated a preexisting plan to move all of its technology infrastructure out of its data centers and into the cloud environment of Citywide's parent company
Conducted a password reset
Strengthened endpoint and Active Directory controls
Enhanced its logging and monitoring implementation
Strengthened email filtering controls
Offering 24 months of free identity theft and credit monitoring services through Kroll
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(113 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 9 states

View merged incident ↗

Illinois State AGJan 1 · first

Maine State AG+41d

Massachusetts State AG+41d

Indiana State AG+42d

Montana State AG+42d

California State AG+46d

Washington State AG+77d

Oregon State AG+77d

Maine State AG+77d

New Hampshire State AG+80d · this page

Maine State AG+83d

Pattern: first filing Jan 1 (IL), last Mar 25 (ME) — a 83-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/citywide-home-loans-20210322.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 22, 2021
Raw hash: 326570f99c3ab309c478a97f49c05e7856b5ab2d184db3d1647a0ee097f1d679

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityCITYWIDE HOME LOANS, LLC

Victim entityCITYWIDE HOME LOANS, LLC

Incidentdiscovered Nov 29, 2020

Stated responseTook a number of its systems offline as a precautionary measure

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov