Social EngineeringFinancial ServicesFinancePhishingCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

SA Stone Wealth Management, Inc.

bd_be065d88311f41f1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 28, 2018

Filed

Apr 30, 2018

To disclose

9 weeks

Affected

2state residents only

Linked

2 filings

Confidence

66%

Full breach record for SA Stone Wealth Management, Inc. →2 incidents on file

SA Stone Wealth Management Inc. notified Montana residents that an employee's email account was compromised via a phishing link on or about February 28, 2018. The attacker attempted to spread malware to contacts. Customer data potentially accessed included names, addresses, birthdates, phone numbers, account numbers, emails, and SSNs. The company reset passwords and provided one year of Experian identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 61 days

Feb 28, 2018

Discovered

Apr 30, 2018

Filed

vs. sector median

on median

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_6899aea472299f932018-05-02 · +2dVerified

Name: SA Stone Wealth Management, Inc.
norm: sa stone wealth management
Domain: saswealth.com

Name: SA Stone Wealth Management, Inc.
norm: sa stone wealth management
Domain: saswealth.com
Industry: Financial Servicesllm

Discovered: Feb 28, 2018
Materiality determined: —
Notification sent: Apr 30, 2018
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Changed e-mail password
Worked with technology personnel to ensure virus software is up-to-date
Checked computer for malicious software
Arranged for one year of Experian’s Identity Restoration service
Arranged for one-year membership to Experian’s IdentityWorks service
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGApr 30 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/SA-Stone-Wealth-1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 30, 2018
Raw hash: 6f63332dc955d7025a8571b90269a7d2da9e48d23a492361cd7b1578e422cbd1

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySA Stone Wealth Management, Inc.

Victim entitySA Stone Wealth Management, Inc.

Incidentdiscovered Feb 28, 2018

Stated responseChanged e-mail password

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov