HackingFinancial ServicesFinanceSupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)LowContained

TRADEZERO AMERICA, INC.

bd_c66ea600f46a7580 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 29, 2024

Filed

Sep 19, 2024

To disclose

7 weeks

Affected

60state residents only

Linked

7 filings

Confidence

67%

Full breach record for TRADEZERO AMERICA, INC. →

TradeZero America Inc. notified New Hampshire residents of a security incident involving its third-party vendor, Tawk.To. On or around July 29, 2024, TradeZero detected suspicious activity on the Tawk.To platform, potentially exposing customer communication data. TradeZero notified federal law enforcement and offered 12 months of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 52 days

Jul 29, 2024

Discovered

Sep 19, 2024

Filed

vs. sector median

1 wks faster

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Maine State AGbd_23d0e16efaa82b002024-09-19Candidate
Massachusetts State AGbd_5160a4280e3bad062024-09-19Verified
California State AGbd_62f236eaafb483552024-09-19Verified
Indiana State AGbd_a004f9015b01165b2024-09-19Verified

Show 2 more filings ↓up to 18d gap

Montana State AGbd_c1b1002275e8fced2024-09-19Verified
Illinois State AGbd_e1115c7d2bc7f4462024-09-01 · +18dVerified

Name: TRADEZERO AMERICA, INC.
norm: tradezero america
Domain: tradezero.com

Name: TRADEZERO AMERICA, INC.
norm: tradezero america
Domain: tradezero.com
Industry: Financial Servicesllm

Discovered: Jul 29, 2024
Materiality determined: —
Notification sent: Sep 19, 2024
Affected individuals: 60state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: notified federal law enforcement regarding the eventproviding written notice of this incident to relevant state and federal regulators
Initial access: supply_chain

During the incident: Moved quickly to investigate and respond to the incident
Assess the security of TradeZero systems
Identify potentially affected individuals
Notified federal law enforcement regarding the event
Providing access to credit monitoring services for , through TransUnion
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Providing written notice of this incident to relevant state and federal regulators
Providing written notice... to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Reviewing our policies procedures and processes related to the storage and access of personal information to reduce the likelihood of a similar future event
Reset your TradeZero account password
Implement two factor authentication with respect to your account
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Illinois State AGSep 1 · first

Maine State AG+18d

Massachusetts State AG+18d

California State AG+18d

Indiana State AG+18d

Montana State AG+18d

New Hampshire State AG+18d · this page

Pattern: first filing Sep 1 (IL), last Sep 19 (NH) — a 18-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/tradezero-america-20240919.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 19, 2024
Raw hash: bf49eafa535e097669eb28fd5b699c7d615b5631131a837481b2c94c0a863c82

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityTRADEZERO AMERICA, INC.

Victim entityTRADEZERO AMERICA, INC.

Incidentdiscovered Jul 29, 2024

Stated responseMoved quickly to investigate and respond to the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov