HackingStolen CredentialsCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTEMPLOYMENTMediumContained
CNU Online Holdings, LLC
bd_d512eb1b597f5b6b · schema v1 · pii pii-v1
Full breach record for CNU Online Holdings, LLC →NetCredit discovered on Feb 20, 2018, that an unauthorized party used valid email addresses and passwords to access a small percentage of accounts. The attacker changed personal information and completed new loan applications. Affected data included names, addresses, last 4 digits of SSN and bank accounts, and employment info. NetCredit blocked the attacker and restricted account access.
California clockDiscovered Feb 20, 2018 → Notified Mar 1, 20189d ✓ CA 60-day OK27 days discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_6e2f05cd61fffc60Montana State AGfiled 2018-03-08(11d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-134540
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 19, 2018
- Raw hash
- 926dee9761d71a818763184b4e0c39e0c84163fd169c05698f38926574cac032
Reporting entity
- Name
- CNU Online Holdings, LLCnorm: cnu online
- Domain
- netcredit.com
Victim entity
- Name
- CNU Online Holdings, LLCnorm: cnu online
- Domain
- netcredit.com
Incident
- Discovered
- Feb 20, 2018
- Materiality determined
- —
- Notification sent
- Mar 1, 2018
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTEMPLOYMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 27 days(27 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 9d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 20, 2018→ Notified: Mar 1, 20189d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.