HackingTechnologyInformationPhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDHighContained

SET FORTH, LLC

bd_dac80c060386e2cd · schema v1 · pii pii-v1

Severity

High

Discovered

May 1, 2024

Filed

Nov 8, 2024

To disclose

27 weeks

Affected

23,515state residents only

Linked

9 filings

Confidence

65%

Full breach record for SET FORTH, LLC →2 incidents on file

Set Forth, Inc., a cloud-based CRM provider, notified individuals in November 2024 of a May 2024 incident where suspicious activity led to unauthorized access of business documents containing PII (names, addresses, SSNs). The company engaged forensic experts, secured the network, and offered 24 months of identity theft protection.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due27 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 27 weeks / 191 days

May 1, 2024

Discovered

Nov 8, 2024

Filed

vs. sector median

+9 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Maine State AGbd_053b1cfa2730f6dc2024-11-08Candidate
Indiana State AGbd_19bd4a8cd27b51a72024-11-08Verified
Vermont State AGbd_86c3ebcdc62180e52024-11-08Verified
Washington State AGbd_8d314c7b9b94e31e2024-11-08Verified

Show 4 more filings ↓up to 7d gap

Montana State AGbd_a04866eaf2ae89642024-11-08Verified
California State AGbd_add6e355c7826d482024-11-08Verified
Delaware State AGbd_e05ab144b791977d2024-11-08Verified
Illinois State AGbd_f7422bf0dad1b5362024-11-01 · +7dVerified

Name: SET FORTH, LLC
norm: set forth

Name: SET FORTH, LLC
norm: set forth
Industry: Technologyllm

Discovered: May 1, 2024
Materiality determined: —
Notification sent: Nov 8, 2024
Affected individuals: 23,515state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Implemented incident response protocols
Took steps to secure the network
Engaged independent computer forensic experts to assist us in conducting an investigation
Changes made: Hardened its web application firewalls
Completed additional third-party penetration testing
Added additional full-time resources for security specific code reviews and anomalous system user/activity behavior
Enhanced other existing security controls
Offering identity theft protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(191 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGNov 1 · first

Maine State AG+7d

Indiana State AG+7d

Vermont State AG+7d

Washington State AG+7d

Montana State AG+7d

California State AG+7d

Delaware State AG+7d

South Carolina State AG+7d · this page

Pattern: first filing Nov 1 (IL), last Nov 8 (SC) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/SetForthInc.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 8, 2024
Raw hash: 74a4801c80ad5206e2c300b4ba275d4e438de833acbed872584b3071a11a0911

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entitySET FORTH, LLC

Victim entitySET FORTH, LLC

Incidentdiscovered May 1, 2024

Stated responseImplemented incident response protocols

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov