MalwareFinancial ServicesFinancePhishingStolen CredentialsRansomwareMulti-Stage ChainData ExfiltratedData EncryptedRansom DemandedOpportunisticIdentity (basic)Government IDHealth (basic)PHIMediumContained

CNA FINANCIAL CORPORATION

bd_bdd258432c11e629 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 21, 2021

Filed

Jul 12, 2021

To disclose

16 weeks

Affected

205state residents only

Linked

9 filings

Confidence

66%

Full breach record for CNA FINANCIAL CORPORATION →

CNA Financial Corporation reported a ransomware attack discovered on March 21, 2021. The threat actor accessed systems starting March 5, 2021, via a fake browser update, stole credentials, and exfiltrated data to a Mega account before deploying ransomware. 205 New Hampshire residents were affected, with data including names, SSNs, and some PHI. CNA recovered the data and reported to the FBI. Notification began July 9, 2021.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 16 days

discovery → filing · 16 weeks / 113 days

Mar 5, 2021

Begins

Mar 21, 2021

Discovered

Jul 12, 2021

Filed

vs. sector median

+8 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Montana State AGbd_107e3f0f52c95ee92021-07-09 · +3dVerified
Oregon State AGbd_8f8adf6678098d272021-07-09 · +3dVerified
Indiana State AGbd_eb7c4eb9cabf7a572021-07-09 · +3dVerified
California State AGbd_2498cf3d61584cfe2021-07-08 · +4dCandidate

Show 4 more filings ↓up to 4d gap

Massachusetts State AGbd_53180e7c81f57e152021-07-08 · +4dVerified
HHS OCRbd_641fa664e7fa983f2021-07-08 · +4dVerified
Maine State AGbd_7abcb947b9a916802021-07-08 · +4dVerified
Washington State AGbd_7f8a3a5d1d0c1ff62021-07-08 · +4dVerified

Name: Norton Rose Fulbright US LLP
norm: norton rose fulbright us

Name: CNA FINANCIAL CORPORATION
norm: cna financial
Domain: cna.com
Industry: Financial Servicesllm

Discovered: Mar 21, 2021
Breach occurred: Mar 5, 2021 – Mar 21, 2021
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 9, 2021
Affected individuals: 205state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1070 Indicator Removal
Threat actor: ExternalFinancial
Regulator citations: Reported the Incident to federal law enforcement (FBI)
Initial access: phishing_link

During the incident: Began implementing containment steps
Engaged third-party cybersecurity experts to assist
Reported the Incident to federal law enforcement
Proactively disconnected systems globally
Took control of the threat actor's Mega Account and recovered data
Conducting dark web scans and searches for CNA-related information
Changes made: Deploying additional endpoint detection and response tools to systems across the environment
Enhancing network restrictions
Accelerating its existing project to implement an advanced privilege access management solution
Engaging a new managed security service provider
Working with external cybersecurity experts to evaluate additional opportunities to further enhance CNA’s information security program
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(113 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

California State AGJul 8 · first

Massachusetts State AGJul 8 · first

HHS OCRJul 8 · first

Maine State AGJul 8 · first

Washington State AGJul 8 · first

Montana State AG+1d

Oregon State AG+1d

Indiana State AG+1d

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cna-financial-20210712.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 12, 2021
Raw hash: 3e44bf51dd80d3835fe627ea98938abe587bfbea3a8ec26747d3ca3147115cc3

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityNorton Rose Fulbright US LLP

Victim entityCNA FINANCIAL CORPORATION

Incidentdiscovered Mar 21, 2021

Stated responseBegan implementing containment steps

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov