HackingFinancial ServicesTechnologyFinanceStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountHighContained

Ingo Money

bd_d33dcc1e99dcc9cb · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 23, 2023

Filed

Jul 2, 2024

To disclose

32 weeks

Affected

1,550state residents only

Linked

7 filings

Confidence

69%

Full breach record for Ingo Money →

Ingo Money, Inc. notified Washington AG of a data breach affecting 1,550 residents. Unauthorized access occurred on or about Nov 23, 2023, involving personal info (names, SSNs, driver's licenses, financial data). Notifications sent June 26, 2024. Law enforcement notified; credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d32 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 32 weeks / 222 days

Nov 23, 2023

Begins

Nov 23, 2023

Discovered

Jul 2, 2024

Filed

vs. sector median

+23 wks slower

This filing is one of 7 about the same incident.View merged incident

A leak claim by inc_ransom about this victim predates this filing by 222 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteinc_ransombd_d5319e025594e9522023-11-23 · +222dVerified

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_591665c46a2cdd4d2024-06-29 · +3dVerified
Massachusetts State AGbd_5fad210b837d2a462024-07-08 · +6dVerified
Indiana State AGbd_07deaf206dcd878a2024-06-26 · +6dCandidate
Maine State AGbd_10f7c83fa3539c482024-08-05 · +34dVerified

Show 1 more filing ↓up to 36d gap

California State AGbd_9aca85417932278e2024-08-07 · +36dVerified

Name: Nelson Mullins Riley & Scarborough LLP
norm: nelson mullins riley scarborough

Name: Ingo Money
norm: ingo money
Domain: ingomoney.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Nov 23, 2023
Breach occurred: Nov 23, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 26, 2024
Affected individuals: 1,550state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: NameSocial Security numberDriver's licence numberFinancial account number
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General
Initial access: valid_credentials

During the incident: Outside cyber professionals promptly investigated
Outside technical experts were engaged and further enhanced the security of our systems
Law enforcement was notified
Security team and third-party cyber professionals will continue to closely monitor our systems 24/7/365 for any unusual activity
Notifying affected individuals
Changes made: Enhanced the security of our systems
24/7/365 Monitoring for any unusual activity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(222 days from discovery to filing)
Compliance flags: WA AG >90dLeak >180d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Indiana State AGJun 26 · first

Massachusetts State AG+3d

Washington State AG+6d · this page

Massachusetts State AG+12d

Maine State AG+40d

California State AG+42d

Pattern: first filing Jun 26 (IN), last Aug 7 (CA) — a 42-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM17550.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 2, 2024
Raw hash: 26cc44f9b4a23e53b874361b48ed3df6c11448c041d066b135b0a51d6c719c65

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityNelson Mullins Riley & Scarborough LLP

Victim entityIngo Money

Incidentdiscovered Nov 23, 2023

Stated responseOutside cyber professionals promptly investigated

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com