HackingFinancial ServicesTechnologyFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

TRADEZERO AMERICA, INC.

bd_c1b1002275e8fced · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 29, 2024

Filed

Sep 19, 2024

To disclose

7 weeks

Affected

31state residents only

Linked

7 filings

Confidence

65%

Full breach record for TRADEZERO AMERICA, INC. →

TradeZero America Inc notified Montana and Rhode Island residents of a security incident involving third-party vendor Tawk.To. On or around July 29, 2024, TradeZero learned of suspicious activity on the Tawk.To platform. An unauthorized actor may have accessed customer communications containing names, SSNs, driver's licenses, financial account info, and passport numbers. TradeZero offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 52 days

Jul 29, 2024

Discovered

Sep 19, 2024

Filed

vs. sector median

1 wks faster

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Maine State AGbd_23d0e16efaa82b002024-09-19Candidate
Massachusetts State AGbd_5160a4280e3bad062024-09-19Verified
California State AGbd_62f236eaafb483552024-09-19Verified
Indiana State AGbd_a004f9015b01165b2024-09-19Verified

Show 2 more filings ↓up to 18d gap

New Hampshire State AGbd_c66ea600f46a75802024-09-19Verified
Illinois State AGbd_e1115c7d2bc7f4462024-09-01 · +18dVerified

Name: TRADEZERO AMERICA, INC.
norm: tradezero america
Domain: tradezero.com

Name: TRADEZERO AMERICA, INC.
norm: tradezero america
Domain: tradezero.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Jul 29, 2024
Materiality determined: —
Notification sent: Sep 19, 2024
Affected individuals: 31state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Notifying applicable regulatory authorities
Third party: via Tawk.To
Initial access: supply_chain

During the incident: Launched an investigation
Confirming the security of our systems
Reviewing the contents of relevant data for sensitive information
Notifying impacted individuals
Reviewing policies procedures and processes related to the storage and access of personal information
Offering twelve (12) months of complimentary access to credit monitoring services through Cyberscout
Notifying applicable regulatory authorities
Changes made: Reviewing policies procedures and processes related to the storage and access of personal information to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Illinois State AGSep 1 · first

Maine State AG+18d

Massachusetts State AG+18d

California State AG+18d

Indiana State AG+18d

New Hampshire State AG+18d

Montana State AG+18d · this page

Pattern: first filing Sep 1 (IL), last Sep 19 (MT) — a 18-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1695.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 19, 2024
Raw hash: b3c93b58d48f0135b48fe05309c5c36998552a25dd51f39ceebf08854608280e

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityTRADEZERO AMERICA, INC.

Victim entityTRADEZERO AMERICA, INC.

Incidentdiscovered Jul 29, 2024

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov