HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancialMediumContained

Presti & Naegele

bd_d5a998c686e6ffc2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 14, 2018

Filed

Mar 23, 2018

To disclose

5 weeks

Affected

3state residents only

Linked

2 filings

Confidence

66%

Full breach record for Presti & Naegele →

Presti & Naegele notified South Carolina regulators of a cyber intrusion discovered on Feb 14, 2018, involving its third-party vendor CCH Client Access Portal. The incident exposed clients' names, addresses, SSNs, and tax return data. The firm engaged forensic investigators, enhanced security, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 37 days

Feb 14, 2018

Discovered

Mar 23, 2018

Filed

vs. sector median

12 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_ccd78c3b7d7e5aea2018-03-21 · +2dCandidate

Name: Presti
norm: presti
Domain: prestisbakery.com

Name: Presti & Naegele
norm: presti naegele
Industry: Professional Servicesllm

Discovered: Feb 14, 2018
Materiality determined: —
Notification sent: Mar 12, 2018
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: notified the appropriate federal, state and local authorities who are also investigating this matter
Initial access: supply_chain

During the incident: Conducted an internal root-cause analysis
User entitlements were changed
Monitoring of system logs was enhanced
Notified the appropriate federal, state and local authorities
Engaged an independent computer forensic firm
Reviewing internal policies and data management
Implemented enhanced security measures
All employees will be retrained on Cybersecurity and Privacy best practices
Arranged for you to enroll, at no cost to you, in an online credit monitoring service (myTrueldentity) for one year provided by TransUnion Interactive
Changes made: Implemented enhanced security measures
All employees will be retrained on Cybersecurity and Privacy best practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMar 21 · first

South Carolina State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/Presti%26Naegele.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 23, 2018
Raw hash: 7a02e1fd76355fc7c5a6c0700b1210d28715f305e328c4a90abb812f3e2dff41

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPresti

Victim entityPresti & Naegele

Incidentdiscovered Feb 14, 2018

Stated responseConducted an internal root-cause analysis

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov