Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Pendrick Capital Partner Holdings, LLC

bd_bc01fb206a779df4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 14, 2021

Filed

Aug 23, 2021

To disclose

14 weeks

Affected

19state residents only

Linked

6 filings

Confidence

65%

Full breach record for Pendrick Capital Partner Holdings, LLC →

Pendrick Capital Partners disclosed unauthorized access to employee email accounts between April 12 and May 14, 2021, discovered on May 14, 2021. The incident involved phishing leading to credential compromise. Potentially affected data included names, SSNs, and financial account information. The company engaged forensic investigators, secured accounts, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 32 days

discovery → filing · 14 weeks / 101 days

Apr 12, 2021

Begins

May 14, 2021

Discovered

Aug 23, 2021

Filed

vs. sector median

+5 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_20f8d12fcada7d802021-08-23Candidate
Maine State AGbd_251768df5aee988c2021-08-23Verified
Massachusetts State AGbd_26ac748ef86276b52021-08-23Verified
Indiana State AGbd_e26c81812e7c71682021-08-23Verified

Show 1 more filing ↓up to 7d gap

New Hampshire State AGbd_861ad204f291528c2021-08-30 · +7dVerified

Name: Pendrick Capital Partner Holdings, LLC
norm: pendrick capital partner
Domain: pendrickcp.com

Name: Pendrick Capital Partner Holdings, LLC
norm: pendrick capital partner
Domain: pendrickcp.com
Industry: Financial Servicesllm

Discovered: May 14, 2021
Breach occurred: Apr 12, 2021 – May 14, 2021
Undetected for: 32 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 20, 2021
Affected individuals: 19state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified state regulators, where required
Initial access: phishing_link

During the incident: Took steps to secure the email accounts
Launched an investigation to determine the nature and scope of the incident
Conducted a comprehensive review of the impacted email accounts
Engaged third-party forensic investigators
Notified regulatory authorities
Provided individuals with access to complimentary credit monitoring and identity protection services
Changes made: Reviewed existing policies and procedures relating to data protection and security
Investigated additional security measures to mitigate any risk
Implemented additional safeguards to further secure the information in its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(101 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

California State AGAug 23 · first

Maine State AGAug 23 · first

Massachusetts State AGAug 23 · first

Indiana State AGAug 23 · first

Montana State AGAug 23 · first · this page

New Hampshire State AG+7d

Pattern: first filing Aug 23 (CA), last Aug 30 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/notificationLetter-73.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 23, 2021
Raw hash: f37ae999261fdba1255b56fe6216d939dc9dfd3582e21a066d20ddca2e8124dc

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityPendrick Capital Partner Holdings, LLC

Victim entityPendrick Capital Partner Holdings, LLC

Incidentdiscovered May 14, 2021

Stated responseTook steps to secure the email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov