Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsMulti-Stage ChainCustomer Data InvolvedPIIIdentity (basic)LowContained

Movement Mortgage LLC

bd_c5db8dad3fdbc576 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 29, 2018

Filed

Aug 31, 2018

To disclose

22 weeks

Affected

17state residents only

Linked

6 filings

Confidence

65%

Full breach record for Movement Mortgage LLC →4 incidents on file

Movement Mortgage LLC notified Montana residents that employee email accounts were compromised via phishing between Oct 2017 and Mar 2018. Personal information of loan applicants was accessed. The company engaged forensic investigators, reset credentials, implemented MFA, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 171 days

discovery → filing · 22 weeks / 155 days

Oct 9, 2017

Begins

Mar 29, 2018

Discovered

Aug 31, 2018

Filed

vs. sector median

+13 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Oregon State AGbd_0728f76685a582862018-08-31Candidate
California State AGbd_84611419ab4b36ef2018-08-31Verified
Massachusetts State AGbd_e19737bfce8739492018-08-31Verified
South Carolina State AGbd_506a3e8c608648672018-09-04 · +4dVerified

Show 1 more filing ↓up to 4d gap

New Hampshire State AGbd_6ff550f34d8ab1342018-09-04 · +4dVerified

Name: Movement Mortgage LLC
norm: movement mortgage

Name: Movement Mortgage LLC
norm: movement mortgage
Industry: Financial Servicesllm

Discovered: Mar 29, 2018
Breach occurred: Oct 9, 2017 – Mar 29, 2018
Undetected for: 171 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 24, 2018
Affected individuals: 17state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Launched an investigation, with the assistance of a third party forensic investigator
Reset the email login credentials for all employee email accounts
Specifically monitoring all email accounts for suspicious log-ins
Implemented multi-factor authentication on all email accounts
Increased our Information Technology security staff
Arranged to have Experian protect your identity for 1 year at no cost
Changes made: Implementing additional training and education for employees
Continue to implement additional system scanning and monitoring programs
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(155 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Oregon State AGAug 31 · first

California State AGAug 31 · first

Massachusetts State AGAug 31 · first

Montana State AGAug 31 · first · this page

South Carolina State AG+4d

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Movement-Mortgage-LLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 31, 2018
Raw hash: 7b37c57aa74ab0cafda0edf940e523b07fc8a78ae486f6e7c15266ed651c4279

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMovement Mortgage LLC

Victim entityMovement Mortgage LLC

Incidentdiscovered Mar 29, 2018

Stated responseLaunched an investigation, with the assistance of a third party forensic investigator

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov