HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDFinancial accountHighContained

J.P. Morgan Benefit Payment Services

bd_c51773ef9a0a61a7 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 26, 2024

Filed

May 9, 2024

To disclose

10 weeks

Affected

1,198state residents only

Linked

2 filings

Confidence

66%

Full breach record for J.P. Morgan Benefit Payment Services →

J.P. Morgan Benefit Payment Services notified NH AG of a data incident affecting 1,198 NH residents. Unauthorized access occurred via a software issue allowing three authorized users (employed by clients) to download reports containing PII/financial data between Aug 2021 and Feb 2024. Discovered Feb 26, 2024. Notifications sent April 18, 2024, with credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 914 days

discovery → filing · 10 weeks / 73 days

Aug 26, 2021

Begins

Feb 26, 2024

Discovered

May 9, 2024

Filed

vs. sector median

+2 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Illinois State AGbd_b805847c898186982024-05-01 · +8dVerified by operator

Name: J.P. Morgan Benefit Payment Services
norm: jp morgan benefit payment

Name: J.P. Morgan Benefit Payment Services
norm: jp morgan benefit payment
Industry: Financial Servicesllm

Discovered: Feb 26, 2024
Breach occurred: Aug 26, 2021 – Feb 23, 2024
Undetected for: 914 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 18, 2024
Affected individuals: 1,198state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: valid_credentials

During the incident: Promptly updated the system's access controls and tested and applied a software update
Confirmed that the three individuals did not have the ability to modify records of residents
Employers confirmed deletion of the reports from active drives
Employers are monitoring backup files for any potential restoration of the personal information
Notified residents of this incident by letter mailed on April 18, 2024
Offered free credit monitoring
Changes made: Applied a software update to address the access issue
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(73 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Illinois State AGMay 1 · first

New Hampshire State AG+8d · this page

Pattern: first filing May 1 (IL), last May 9 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/j-p-morgan-benefit-payment-services-20240509.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 9, 2024
Raw hash: 2a2cb81c8ca4e185c7f69f8914c8b2be003557369b75185b485be5bad695aac6

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityJ.P. Morgan Benefit Payment Services

Victim entityJ.P. Morgan Benefit Payment Services

Incidentdiscovered Feb 26, 2024

Stated responsePromptly updated the system's access controls and tested and applied a software update

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov