HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDFinancialMediumResolved

Seterus, Inc

bd_c0dbb63b12c4206a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 18, 2018

Filed

May 10, 2018

To disclose

22 days

Affected

2state residents only

Linked

2 filings

Confidence

64%

Full breach record for Seterus, Inc →9 incidents on file

Seterus, Inc. notified Montana AG of a data breach on May 11, 2018, regarding unauthorized disclosure of personal information (names, SSNs, addresses, loan numbers) sent to an unauthorized party on April 18, 2018. The company offered credit monitoring and requested data destruction.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 22 days

Apr 18, 2018

Begins

Apr 18, 2018

Discovered

May 10, 2018

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_5164759fa7eb95042018-04-30 · +10dCandidate

Name: Seterus, Inc
norm: seterus
Domain: seterus.com

Name: Seterus, Inc
norm: seterus
Domain: seterus.com
Industry: Financial Servicesllm

Discovered: Apr 18, 2018
Breach occurred: Apr 18, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 11, 2018
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1534 Internal Remote Services
Threat actor: External
Regulator citations: Notified the appropriate state agency
Initial access: valid_credentials

During the incident: Notified the appropriate state agency
Requested the recipient destroy the data that was received in error
Offering complimentary credit monitoring service through Kroll Inc.
Changes made: Taken additional security steps to help prevent future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGApr 30 · first

Montana State AG+10d · this page

Pattern: first filing Apr 30 (MA), last May 10 (MT) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Seterus.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 10, 2018
Raw hash: a26ca4dd37fe1ebb22130ffc573752e7da4609281628e3e1fd7c2339c6fecb2f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySeterus, Inc

Victim entitySeterus, Inc

Incidentdiscovered Apr 18, 2018

Stated responseNotified the appropriate state agency

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov