HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedPIIFinancialLowContained

MG Stover

bd_ce6cef878a121f0b · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 20, 2023

Filed

Oct 10, 2023

To disclose

20 days

Affected

2state residents only

Confidence

67%

Full breach record for MG Stover →

MG Stover, a fund administrator for Off the Chain LP, experienced a security incident involving unauthorized access to its Retool administrator account. The breach, discovered on September 20, 2023, affected two New Hampshire residents. The unauthorized party accessed Retool managed service customer systems. MG Stover contained the incident, rotated credentials, enabled MFA, and notified affected individuals on October 2, 2023, offering one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 20 days

Sep 20, 2023

Discovered

Oct 10, 2023

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: MG Stover
norm: mg stover

Name: MG Stover
norm: mg stover
Industry: Financial Servicesllm

Discovered: Sep 20, 2023
Materiality determined: —
Notification sent: Oct 2, 2023
Affected individuals: 2state-resident count only
Data types: PIIFinancial
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Third party: via Retool
Initial access: trusted_relationship

During the incident: Began an internal investigation
Reviewed all Retool user accounts
Assessed the impact of the event
Rotated the credentials of the breached user
Enabled MFA for all users
Reviewed all user activity logs within Retool
Reviewed other managed services with sensitive data access
Initiated a review of data access to ensure minimal sensitive data exposure to Retool
Initiated an evaluation of alternative service providers to Retool
Sent notices to the two individuals
Offered free credit monitoring for one year
Changes made: Enabled MFA for all users
Initiated an evaluation of alternative service providers to Retool
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/off-the-chain-mg-stover-20231010.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 10, 2023
Raw hash: 572cc152b10950f6fb05598cb70f29e5e7c232c8032b25073e30c8b61d93642b

Reporting entityMG Stover

Victim entityMG Stover

Incidentdiscovered Sep 20, 2023

Stated responseBegan an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov