HackingFinancial ServicesProfessional ServicesFinanceStolen CredentialsCustomer Data InvolvedTargetedHealth (basic)Identity (basic)PHIPIIMediumActive

Woodruff Sawyer & Co.

bd_d237dca2559a135f · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 1, 2020

Filed

Nov 10, 2020

To disclose

28 weeks

Affected

2,393state residents only

Linked

4 filings

Confidence

69%

Full breach record for Woodruff Sawyer & Co. →6 incidents on file

Woodruff Sawyer & Co. notified the Washington AG of unauthorized access to employee email accounts between March 2-3, 2020. The incident affected 2,393 Washington residents, primarily involving names, DOBs, and health/claims data. Access was gained via compromised credentials. Remediation included MFA implementation and credit monitoring offers.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d28 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 60 days

discovery → filing · 28 weeks / 193 days

Mar 2, 2020

Begins

May 1, 2020

Discovered

Nov 10, 2020

Filed

vs. sector median

+19 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_a4ee49c5e2e7c8d22020-11-09 · +1dCandidate
Oregon State AGbd_3becb4dbc41e61352020-11-12 · +2dVerified by operator
California State AGbd_05d436bb4d52abd62020-12-08 · +28dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Woodruff Sawyer & Co.
norm: woodruff sawyer
Domain: woodruffsawyer.com
Industry: Financial ServicesllmProfessional Servicesllm

Discovered: May 1, 2020
Breach occurred: Mar 2, 2020 – Mar 3, 2020
Undetected for: 60 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 9, 2020
Affected individuals: 2,393state-resident count only
Data types: Health (basic)Identity (basic)PHIPII
Data elements: NameDate of birthMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Provided notice to Washington Attorney General
Initial access: valid_credentials

During the incident: Secured the email accounts by changing the account credentials
Launched an investigation, which included working with a third-party forensic investigator
Began a programmatic and manual review of the contents of the email accounts
Reset the email account passwords
Confirmed the security of relevant systems
Reviewed policies and procedures
Implemented additional safeguards and training to its employees including multi-factor authentication across the organization
Provided the impacted individuals with access to twelve months (12) of credit and identity monitoring services, through Kroll, at no cost to these individuals
Changes made: Implemented multi-factor authentication across the organization
Provided additional training to its employees on data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(193 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGNov 9 · first

Washington State AG+1d · this page

Oregon State AG+3d

California State AG+29d

Pattern: first filing Nov 9 (MT), last Dec 8 (CA) — a 29-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10359.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 10, 2020
Raw hash: 2f43561abc0aa4d01d32aa7afa0b36026f0a7a7218bed4813d7b74f21a14ebae

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityWoodruff Sawyer & Co.

Incidentdiscovered May 1, 2020

Stated responseSecured the email accounts by changing the account credentials

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com