HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumActive
CALDWELL SUTTER CAPITAL, INC.
bd_dc8ad24a2c5902af · schema v1 · pii pii-v1
Full breach record for CALDWELL SUTTER CAPITAL, INC. →Caldwell Sutter Capital, Inc. disclosed a data breach involving third-party provider FoxTrot, LLC. Unauthorized access occurred on April 22, 2026, exposing customer names, account numbers, and Social Security numbers. The investigation is ongoing. The company offered 24 months of credit monitoring via Experian IdentityWorks and identity restoration services.
Massachusetts clock⏱ MA AG >30d5 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_7fd3aefede554e9eIndiana State AGfiled 2026-05-29(3d gap)Verified
- bd_92d7fd2ed3036b1bMaine State AGfiled 2026-06-11(10d gap)Candidate
- bd_37339e913805b8d7Vermont State AGfiled 2026-06-12(11d gap)Verified
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-959-caldwell-sutter-capital-inc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 1, 2026
- Raw hash
- 78da31d9ff1f5da2256398224268adfc4e03bd7b766a25893f094bd96601e952
Reporting entity
- Name
- CALDWELL SUTTER CAPITAL, INC.norm: caldwell sutter
- Domain
- cald.com
Victim entity
- Name
- CALDWELL SUTTER CAPITAL, INC.norm: caldwell sutter
- Domain
- cald.com
Incident
- Discovered
- Apr 29, 2026
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Regulator citations
- Evaluating and making notifications to regulators and other authorities as required by applicable state and federal law
- Third party
- via FoxTrot, LLC
- Initial access
- supply_chain
Compliance
- Time to disclose
- 5 weeks(33 days from discovery to filing)
- Compliance flags
- MA AG >30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.