HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)TargetedPIIIdentity (basic)EmploymentLowContained

Lobel Financial

bd_bbe0901dbf97925a · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 25, 2023

Filed

Nov 6, 2023

To disclose

15 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

67%

Full breach record for Lobel Financial →

Lobel Financial Corporation notified consumers of a data breach stemming from a third-party supplier, CBIZ, which was compromised via the MOVEit zero-day vulnerability. The incident exposed personal information including names, dates of birth, FICO scores, and employment data. No SSNs or government IDs were compromised. CBIZ shut down the FTP site and patched the server; Lobel and JPMorgan Chase are monitoring the situation.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday15 weeks discovery → filing

Incident timeline

undetected · 56 days

discovery → filing · 15 weeks / 104 days

May 30, 2023

Begins

Jul 25, 2023

Discovered

Nov 6, 2023

Filed

vs. sector median

+7 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_dfd6af56640a2e392023-11-09 · +3dCandidate
Massachusetts State AGbd_e48664903e956e042023-11-09 · +3dVerified

Name: Lobel Financial
norm: lobel financial
Domain: lobelfinancial.com

Name: Lobel Financial
norm: lobel financial
Domain: lobelfinancial.com
Industry: Financial Servicesllm

Discovered: Jul 25, 2023
Breach occurred: May 30, 2023
Undetected for: 56 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 6, 2023
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Employment
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Third party: via CBIZ
Initial access: exploit_public_facing

During the incident: CBIZ shut down the FTP site
Began a forensic review
The impacted MOVEit server was restored to the last-known-good configuration and patched
JPMorgan is evaluating additional preventative measures
JPMorgan cyber security department is continuing to monitor the situation
Lobel is continuing to monitor the situation
Changes made: The impacted MOVEit server was restored to the last-known-good configuration and patched
JPMorgan is evaluating additional preventative measures and best practices to recommend to CBIZ
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(104 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Vermont State AGNov 6 · first · this page

California State AG+3d

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-11-06-lobel-financial-corporation-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 6, 2023
Raw hash: d6d3ec785a6f5242375c940327c991a67e123cd7feeb5e3158992fdf1f43a7fc

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityLobel Financial

Victim entityLobel Financial

Incidentdiscovered Jul 25, 2023

Stated responseCBIZ shut down the FTP site

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov