HackingFinancial ServicesFinanceStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

THE CHARLES SCHWAB CORPORATION

bd_dc34befdc46ad461 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 25, 2016

Filed

Nov 11, 2016

To disclose

33 weeks

Affected

975state residents only

Confidence

66%

Full breach record for THE CHARLES SCHWAB CORPORATION →9 incidents on file

Charles Schwab & Co. Inc. notified Washington AG that a 'Credential Replay' incident involving stolen usernames and passwords affected 975 Washington residents starting March 25, 2016. Unauthorized parties accessed names, emails, and account numbers; some attempted unauthorized transfers. Schwab restricted access, notified the FBI, and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 33 weeks / 231 days

Mar 25, 2016

Begins

Mar 25, 2016

Discovered

Nov 11, 2016

Filed

vs. sector median

+25 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed975 affectedView incident

Name: THE CHARLES SCHWAB CORPORATION
norm: the charles schwab

Name: THE CHARLES SCHWAB CORPORATION
norm: the charles schwab
Industry: Financial Servicesllm

Discovered: Mar 25, 2016
Breach occurred: Mar 25, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 15, 2016
Affected individuals: 975state-resident count only
Data types: Identity (basic)Financial account
Data elements: Financial account numberName
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the Federal Bureau of InvestigationNotified primary federal regulators
Initial access: valid_credentials

During the incident: Restricted online account access until identity verification
Monitored accounts for suspicious activity
Notified the Federal Bureau of Investigation
Notified primary federal regulators
Developed controls to block identified perpetrators
Required affected residents to reset passwords
Offered complimentary two-year credit monitoring subscription from Equifax
Changes made: Developed controls to block identified perpetrators without indicating to them whether the credentials they have presented are valid
Reminding customers about good password practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(231 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9653.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 11, 2016
Raw hash: cea051bcb9dd3dd2e9d157aa9c51d6e578e7de93ea64ba1c2cd5fd23436ba66b

Reporting entityTHE CHARLES SCHWAB CORPORATION

Victim entityTHE CHARLES SCHWAB CORPORATION

Incidentdiscovered Mar 25, 2016

Stated responseRestricted online account access until identity verification

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com