AccidentalFinancial ServicesFinanceMisconfigurationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

The Credit Pros

bd_c13caac591aea8fd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 30, 2020

Filed

Jul 30, 2020

To disclose

4 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

66%

Full breach record for The Credit Pros →2 incidents on file

The Credit Pros International Corporation disclosed a data breach involving unauthenticated access to an online storage service due to a vendor misconfiguration. The incident occurred between July 9, 2016, and December 15, 2019, but was discovered on June 30, 2020. Affected data includes names, addresses, Social Security numbers, and driver's license numbers. The company engaged a security firm, corrected access settings, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1452 days

discovery → filing · 4 weeks / 30 days

Jul 9, 2016

Begins

Jun 30, 2020

Discovered

Jul 30, 2020

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_2787c46ee206d1b82020-07-30Verified
Montana State AGbd_7b0bf5b6df6c399c2020-07-30Candidate
Massachusetts State AGbd_ce5c4e56185cb25b2020-07-30Verified
New Hampshire State AGbd_d21771425dff4f042020-07-31 · +1dVerified

Name: The Credit Pros
norm: the credit pros
Domain: thecreditpros.com

Name: The Credit Pros
norm: the credit pros
Domain: thecreditpros.com
Industry: Financial Servicesllm

Discovered: Jun 30, 2020
Breach occurred: Jul 9, 2016 – Dec 15, 2019
Undetected for: 1,452 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Third party: via Online storage service vendor
Initial access: exploit_public_facing

During the incident: Changed the access settings for the service
Engaged a security firm
Conducted a thorough investigation
Offering a complimentary one-year membership to Experian’s IdentityWorks credit monitoring service
Changes made: Continue to take steps to improve data security and prevent future issues
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJul 30 · first

Montana State AGJul 30 · first

Massachusetts State AGJul 30 · first

California State AGJul 30 · first · this page

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-192608
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 30, 2020
Raw hash: d7eadd64f33520abe70d2b89f1bf09cf08c9941828043b11a4162f6f371ee9e8

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityThe Credit Pros

Victim entityThe Credit Pros

Incidentdiscovered Jun 30, 2020

Stated responseChanged the access settings for the service

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov