HackingFinancial ServicesFinanceVulnerability ExploitCustomer Data InvolvedFinancial accountPIILowContained

Progrexion ASG, Inc.

bd_c7acddbaaa1c8df2 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 8, 2021

Filed

Jun 9, 2021

To disclose

9 weeks

Affected

Not disclosed

Linked

11 filings

Confidence

65%

Full breach record for Progrexion ASG, Inc. →2 incidents on file

Progrexion ASG, Inc. reported that a malicious third party used its public-facing platforms to request consumer financial information, including FICO scores, account numbers, and institution identities, between March 3 and April 22, 2021. The incident was discovered on April 8, 2021. Progrexion took its platforms offline and notified the NCCIC. Social Security numbers and passwords were not accessed. Affected individuals were offered 24 months of identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 36 days

discovery → filing · 9 weeks / 62 days

Mar 3, 2021

Begins

Apr 8, 2021

Discovered

Jun 9, 2021

Filed

vs. sector median

on median

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

New Hampshire State AGbd_238445988127ff192021-06-09Verified
Massachusetts State AGbd_8521107b47f87e522021-06-09Verified
South Carolina State AGbd_a8c9c7ce9849f6c92021-06-08 · +1dVerified
Washington State AGbd_aecd5c3cdc8eb9f02021-06-08 · +1dVerified

Show 6 more filings ↓up to 33d gap

Idaho State AGbd_dcc52e70a3f467042021-06-08 · +1dVerified
Delaware State AGbd_758cf1ceced1c3912021-06-16 · +7dVerified
Indiana State AGbd_ea321cd4e88250d92021-06-16 · +7dVerified
Oregon State AGbd_65824fe445e8ec0b2021-05-26 · +14dVerified
Idaho State AGbd_7917507aa07df9d62021-05-12 · +28dCandidate
Maine State AGbd_3c997f440ca227c42021-07-12 · +33dVerified

Name: Progrexion ASG, Inc.
norm: progrexion asg

Name: Progrexion ASG, Inc.
norm: progrexion asg
Industry: Financial Servicesllm

Discovered: Apr 8, 2021
Breach occurred: Mar 3, 2021 – Apr 22, 2021
Undetected for: 36 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 9, 2021
Affected individuals: Not disclosed
Data types: Financial accountPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified the National Cybersecurity Communications and Integration Center (NCCIC)
Initial access: exploit_public_facing

During the incident: Took its public-facing platforms offline to prevent any additional fraudulent requests for information from being made
Notified a law enforcement agency - the National Cybersecurity Communications and Integration Center (NCCIC) - to advise it of the Incident
Arranged and are paying for you to receive a twenty-four (24) month membership in Trans Union’s TrueIdentity theft protection services
Changes made: Evaluating its platforms to determine if additional controls should be implemented to reduce the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

Idaho State AGMay 12 · first

Oregon State AG+14d

South Carolina State AG+27d

Washington State AG+27d

Idaho State AG+27d

New Hampshire State AG+28d

Massachusetts State AG+28d

California State AG+28d · this page

Delaware State AG+35d

Indiana State AG+35d

Maine State AG+61d

Pattern: first filing May 12 (ID), last Jul 12 (ME) — a 61-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-541705
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 9, 2021
Raw hash: 8e6dc08be2eb2c6388244cfbb9fa1ca07300da7a4190a025a5cb003f3b1a0984

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityProgrexion ASG, Inc.

Victim entityProgrexion ASG, Inc.

Incidentdiscovered Apr 8, 2021

Stated responseTook its public-facing platforms offline to prevent any additional fraudulent requests for information from being made

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov