Social EngineeringFinancial ServicesFinancePhishingBECStolen CredentialsTargetedMulti-Stage ChainCustomer Data InvolvedEmployee Data InvolvedRansom DemandedIdentity (basic)Government IDFinancial accountHighResolved

PlanMember Securities Corporation

bd_be1890f84a353419 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 17, 2022

Filed

Apr 15, 2022

To disclose

8 weeks

Affected · nationwide

96,8134,231 in this filing

Linked

12 filings

Confidence

69%

Full breach record for PlanMember Securities Corporation →3 incidents on file

PlanMember Securities Corporation, a financial services firm, reported a cybersecurity incident where a CFO's email account was compromised via a phishing email on February 17, 2022. Attackers attempted Business Email Compromise (BEC) fraud. The incident exposed employee and client PII, including names, SSNs, account numbers, and driver's licenses. 96,813 individuals were notified, including 4,231 in Washington. Notifications were mailed July 1, 2022.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d8 weeks discovery → filing

Incident timeline

discovery → filing · 8 weeks / 57 days

Feb 17, 2022

Begins

Feb 17, 2022

Discovered

Mar 30, 2022

Scope determined

Apr 15, 2022

Filed

vs. sector median

1 wks faster

This filing is one of 12 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

California State AGbd_59916b7518e7d6862022-04-15Candidate
Oregon State AGbd_bf5c1abaa9187ec62022-04-15Verified
Maine State AGbd_d9787ffd1dfd301e2022-04-16 · +1dVerified
Massachusetts State AGbd_f2a6ba76f5b0dbe92022-04-16 · +1dVerified

Show 6 more filings ↓up to 77d gap

Maine State AGbd_52833bfe24c4c9f62022-04-12 · +3dVerified
Indiana State AGbd_4bcbb70533d6c9592022-06-15 · +61dVerified
Maine State AGbd_a44fc4621a30a1b22022-06-27 · +73dVerified
California State AGbd_58d9e5f0a778fdd42022-06-29 · +75dVerified
Hawaii State AGbd_54c7aa065a80fc0c2022-06-30 · +76dVerified
Montana State AGbd_a4b2b687e3b8e7c12022-07-01 · +77dVerified

Showing first 10 of 11 linked disclosures.

Name: PlanMember Securities Corporation
norm: planmember securities
Domain: planmember.com

Name: PlanMember Securities Corporation
norm: planmember securities
Domain: planmember.com
Industry: Financial Servicesllm

Discovered: Feb 17, 2022
Breach occurred: Feb 17, 2022 – Mar 15, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: Mar 30, 2022
Notification sent: Jul 1, 2022
Affected individuals: 96,813state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: NameSocial Security numberFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1530 Data from Cloud Storage ObjectT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney Generalcommunicating about this incident with our regulators across our business linesreported the event to law enforcement and regulators
Initial access: phishing_link

During the incident: Changing passwords and closing all active sessions
Creating new alert mechanisms to identify any automated email rules to outside email addresses
Conducting an initial review of the CFO’s email account to identify any personal information or other sensitive information which may have been subject to unauthorized access
Searching within the firm to identify any other individuals who may have received the phishing email
Examining the CFO’s laptop for any malicious code
Retained outside counsel with expertise in cybersecurity incidents
Retained a leading cyber forensic firm to investigate the root cause and the actions that the attackers took
Alerting its bank to the malicious activity
Contacting the firm’s cyber insurance carrier
Changes made: Implemented a whitelist of known IP addresses that must be used to access internal systems, including email accounts
Disabled the “known device” feature in Microsoft 365
Disabled legacy Microsoft 365 authentication protocols
Implementing a data-loss-prevention tool that will assess outgoing email for personal information and prevent the sender from mailing such information unless the data is attached as an encrypted and password protected file
Modifying its internal policies regarding how certain data types may be stored
Sweep its system to identify where PII or other sensitive data exists
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 8 states

View merged incident ↗

Maine State AGApr 12 · first

California State AG+3d

Oregon State AG+3d

Washington State AG+3d · this page

Maine State AG+4d

Massachusetts State AG+4d

Indiana State AG+64d

Maine State AG+76d

California State AG+78d

Hawaii State AG+79d

Montana State AG+80d

Pattern: first filing Apr 12 (ME), last Jul 1 (MT) — a 80-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA8504.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 15, 2022
Raw hash: e2619870a5e3c0a3f5281e373163cad6a69f8bf86932bdd9d941240a2f4f84eb

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityPlanMember Securities Corporation

Victim entityPlanMember Securities Corporation

Incidentdiscovered Feb 17, 2022

Stated responseChanging passwords and closing all active sessions

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com