HackingFinancial ServicesFinanceTargetedDelayed DiscoveryIdentity (basic)Government IDMediumContained

The Credit Pros

bd_d21771425dff4f04 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 30, 2020

Filed

Jul 31, 2020

To disclose

4 weeks

Affected

29state residents only

Linked

5 filings

Confidence

66%

Full breach record for The Credit Pros →2 incidents on file

The Credit Pros International Corporation notified the NH AG of a security incident involving 29 NH residents. Unauthenticated access to an online storage service occurred from July 2016 to Dec 2019. Affected data included names, addresses, SSNs, and driver's license numbers. Notification sent July 30, 2020.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1452 days

discovery → filing · 4 weeks / 31 days

Jul 9, 2016

Begins

Jun 30, 2020

Discovered

Jul 31, 2020

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_2787c46ee206d1b82020-07-30 · +1dVerified
Montana State AGbd_7b0bf5b6df6c399c2020-07-30 · +1dCandidate
California State AGbd_c13caac591aea8fd2020-07-30 · +1dVerified
Massachusetts State AGbd_ce5c4e56185cb25b2020-07-30 · +1dVerified

Name: BAKER & HOSTETLER LLP
norm: baker hostetler

Name: The Credit Pros
norm: the credit pros
Domain: thecreditpros.com
Industry: Financial Servicesllm

Discovered: Jun 30, 2020
Breach occurred: Jul 9, 2016 – Dec 15, 2019
Undetected for: 1,452 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 30, 2020
Affected individuals: 29state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Changed the access settings for the service
A security firm was engaged
A thorough investigation was conducted
Offering a complimentary one-year membership in credit monitoring and identity theft protection services through Experian
Established a dedicated call center
Changes made: Encrypting the data stored with the online storage service
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJul 30 · first

Montana State AGJul 30 · first

California State AGJul 30 · first

Massachusetts State AGJul 30 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/credit-pros-20200731.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 31, 2020
Raw hash: 75728f98c893531b7b9586671dea0007b8933c826f9bd9b8e6d70a2baed6b01f

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityBAKER & HOSTETLER LLP

Victim entityThe Credit Pros

Incidentdiscovered Jun 30, 2020

Stated responseChanged the access settings for the service

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov