HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountCredentialsHealth (basic)PHIMediumContained

Windes, Inc.

bd_b8a542a0d7990e31 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 19, 2020

Filed

Jul 28, 2020

To disclose

19 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

64%

Full breach record for Windes, Inc. →

Windes, Inc., an accounting and business consulting firm, experienced unauthorized access to two employee email accounts between March 16-19, 2020, and on March 25, 2020. The company discovered the potential compromise on March 19, 2020. Affected data may include names, SSNs, financial account numbers, credentials, and health information. Windes engaged forensic investigators, secured accounts, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 19 weeks / 131 days

Mar 16, 2020

Begins

Mar 19, 2020

Discovered

Jul 28, 2020

Filed

vs. sector median

1 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_159894e2b33015b42020-07-28Candidate
Massachusetts State AGbd_e84b0b62c0f7b2932020-07-28Verified

Name: Windes, Inc.
norm: windes

Name: Windes, Inc.
norm: windes
Industry: Professional Servicesllm

Discovered: Mar 19, 2020
Breach occurred: Mar 16, 2020 – Mar 25, 2020
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountCredentialsHealth (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the suspected account
Engaged a third-party forensics company to investigate
Offering complimentary credit monitoring and identity protection services
Changes made: Took steps to enhance the security of all information to help prevent similar incidents from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(131 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGJul 28 · first

Massachusetts State AGJul 28 · first

California State AGJul 28 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-192476
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 28, 2020
Raw hash: fb71bfcbb9a1a007265c9ee0e90722db67f336aa5008c8a9a67174c3ad18c310

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWindes, Inc.

Victim entityWindes, Inc.

Incidentdiscovered Mar 19, 2020

Stated responseSecured the suspected account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov