MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedData EncryptedTargetedDelayed DiscoveryIdentity (basic)Government IDFinancial accountPHIHealth (basic)MediumContained

FTV Employment Services LLC

bd_c6c00c47aa1c0a83 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 1, 2023

Filed

Oct 1, 2024

To disclose

12 months

Affected

589state residents only

Linked

7 filings

Confidence

68%

Full breach record for FTV Employment Services LLC →

FTV Employment Services LLC reported a cybersecurity incident involving unauthorized access by two third parties between Jan 25 and Nov 6, 2023. The breach affected 589 Washington residents, exposing PII including SSNs, DOBs, driver's licenses, financial account numbers, and PHI. FTV engaged forensic experts, notified law enforcement, and began notifying residents on Oct 3, 2024, offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d12 months discovery → filing

Incident timeline

undetected · 249 days

discovery → filing · 12 months / 366 days

Jan 25, 2023

Begins

Oct 1, 2023

Discovered

Oct 1, 2024

Filed

vs. sector median

+34 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_241b19fa8ef75dc12024-10-01Verified
Maine State AGbd_7e55aa7a26ee671e2024-10-01Verified
Massachusetts State AGbd_0eed94c2aa419d862024-10-03 · +2dVerified
New Hampshire State AGbd_12454e5b47ac97cf2024-10-03 · +2dVerified

Show 2 more filings ↓up to 3d gap

Montana State AGbd_9943bccf721d1b542024-10-03 · +2dVerified by operator
Vermont State AGbd_b88f25415e539c9f2024-10-04 · +3dVerified

Name: FTV Employment Services LLC
norm: ftv employment

Name: FTV Employment Services LLC
norm: ftv employment
Industry: Professional Servicesllm

Discovered: Oct 1, 2023
Breach occurred: Jan 25, 2023 – Nov 6, 2023
Undetected for: 249 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 3, 2024
Affected individuals: 589state-resident count only
Data types: Identity (basic)Government IDFinancial accountPHI
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthPassport numberHealth insurance ID
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 200-299dexposure 200-299d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement authorities

During the incident: Engaged leading external cybersecurity experts to assist in thoroughly investigating the incidents
Worked closely with forensic consultants to investigate, contain, and eradicate the incidents
Notified federal law enforcement authorities of the incidents
Enhanced security monitoring capabilities and technical controls
Issued a precautionary notice about the incident
Offered complimentary credit monitoring to all current employees
Began notifying potentially affected Washington residents
Providing the residents with 24 months of credit monitoring at no charge
Established a dedicated toll-free support line
Changes made: Enhanced security monitoring capabilities and technical controls to further protect the privacy of personal information in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(366 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

California State AGOct 1 · first

Maine State AGOct 1 · first

Washington State AGOct 1 · first · this page

Massachusetts State AG+2d

New Hampshire State AG+2d

Montana State AG+2d

Vermont State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30849.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 1, 2024
Raw hash: d699e947e8bd19c0f7fcb77325bdb9a793c61fd83daaffb0dc3deb599102b35a

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityFTV Employment Services LLC

Victim entityFTV Employment Services LLC

Incidentdiscovered Oct 1, 2023

Stated responseEngaged leading external cybersecurity experts to assist in thoroughly investigating the incidents

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com