Social EngineeringFinancial ServicesFinancePhishingCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

McDonnell Capital

bd_cbe04520a03a8750 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Sep 4, 2025

Filed

Feb 11, 2026

To disclose

—

Affected

4state residents only

Confidence

66%

Full breach record for McDonnell Capital →

McDonnell Capital Management notified the Nebraska AG of a phishing incident where an employee's email was accessed between Aug 29 and Sep 3, 2025. The breach exposed names, SSNs, and financial account info for 4 Nebraska residents. Notifications were sent on Feb 11, 2026, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

Aug 29, 2025

Begins

Sep 4, 2025

Discovered

Feb 11, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4 affectedView incident

Name: McDonnell Capital
norm: mcdonnell capital
Domain: mcdonnell-capital.com

Name: McDonnell Capital
norm: mcdonnell capital
Domain: mcdonnell-capital.com
Industry: Financial Servicesllm

Discovered: Sep 4, 2025
Breach occurred: Aug 29, 2025 – Sep 3, 2025
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 11, 2026
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Investigated with assistance from cybersecurity specialists
Conducted a comprehensive review of the accessed emails
Secured its email environment
Implemented measures to enhance the security of information in its care
Notified all potentially impacted individuals
Offering them access to complimentary identity monitoring services
Established a dedicated call center
Changes made: No longer accept certain customer information via email
Restricting the process for sharing any documents with sensitive information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/18505e75-f829-4295-804f-4b4b3da62657.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 11, 2026
Raw hash: 706fa5858912199f44eac06e0fd11d1e8739b270ab051420f04046e97e429c5b

Reporting entityMcDonnell Capital

Victim entityMcDonnell Capital

Incidentdiscovered Sep 4, 2025

Stated responseInvestigated with assistance from cybersecurity specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov