HackingFinancial ServicesFinanceStolen CredentialsCapture App DataSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Government IDMediumContained

Funding Circle USA, Inc. (Dun & Bradstreet, Inc.)

bd_c6ddb79bfb378989 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Mar 30, 2018

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

75%

Full breach record for Funding Circle USA, Inc. (Dun & Bradstreet, Inc.) →2 incidents on file

A data vendor serving Funding Circle USA experienced unauthorized access to employee email accounts hosted in Microsoft Office 365. The vendor identified the activity in November 2017 and determined Funding Circle customer data was in a compromised account on February 20, 2018. Affected data includes names, addresses, phone numbers, and Social Security numbers. The vendor engaged forensic investigators, notified law enforcement, and implemented MFA and enhanced security controls.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 1, 2017

Begins

Mar 30, 2018

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_3d87d952d97bbbad2018-03-30Candidate
New Hampshire State AGbd_74ef0e4e3e2251412018-03-23 · +7dVerified

Name: Funding Circle USA, Inc. (Dun & Bradstreet, Inc.)
norm: funding circle usa inc dun bradstreet
Domain: fundingcircle.com

Name: Funding Circle USA, Inc. (Dun & Bradstreet, Inc.)
norm: funding circle usa inc dun bradstreet
Domain: fundingcircle.com
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Jun 1, 2017
Materiality determined: —
Notification sent: Mar 1, 2018
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1114 Email CollectionT1195 Supply Chain Compromise
Threat actor: External
Third party: via D&B (data vendor)
Initial access: valid_credentials

During the incident: Data vendor retained a leading cybersecurity forensics firm to conduct a full investigation
Data vendor notified federal law enforcement of the incident
Data vendor installed multi-factor authentication on internal email accounts
Data vendor implemented a stricter password policy
Data vendor integrated enhanced threat monitoring procedures
Funding Circle has been in contact with the data vendor about this incident
Offering complimentary identity protection and credit monitoring services for 12 months through ID Experts® MyIDCare
Changes made: Installation of multi-factor authentication on internal email accounts
Implementation of a stricter password policy
Integration of enhanced threat monitoring procedures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGMar 23 · first

Montana State AG+7d

California State AG+7d · this page

Pattern: first filing Mar 23 (NH), last Mar 30 (CA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-134928
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 30, 2018
Raw hash: 2b22647898fd81acb4085dfa21bed2f92898931bd8b69f163cf2f59e3ec0d89e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFunding Circle USA, Inc. (Dun & Bradstreet, Inc.)

Victim entityFunding Circle USA, Inc. (Dun & Bradstreet, Inc.)

IncidentThird-Party / Supply Chain

Stated responseData vendor retained a leading cybersecurity forensics firm to conduct a full investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov