AccidentalProfessional ServicesProfessional ServicesMisconfigurationCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)BiometricMediumContained

Wing Financial Services

bd_dd0eab397cd0f931 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Dec 5, 2022

To disclose

—

Affected

Not disclosed

Linked

7 filings

Confidence

65%

Full breach record for Wing Financial Services →

Wing Financial Services, LLC, a Jackson Hewitt tax preparation franchise in Bartlesville, Oklahoma, experienced a data security incident on August 7, 2022, when client records were accessible to unauthorized parties on the internet due to a misconfiguration. The company determined on November 10, 2022, that the exposed files contained personally identifiable information, including names, addresses, dates of birth, biometric data, Social Security numbers, driver's license numbers, tax ID numbers, passport numbers, financial account numbers with access codes, payment card numbers, and health insurance policy numbers. Wing Financial immediately limited access to affected servers, hired forensic experts, changed user credentials, and trained employees. Affected individuals were notified on December 1, 2022, and offered 12 months of complimentary credit monitoring and fraud assistance.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 7, 2022

Begins

Dec 5, 2022

Filed

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_ce538ff6fc71d4d92022-12-09 · +4dVerified
Montana State AGbd_222b5057f3b0599e2022-12-01 · +4dCandidate
Maine State AGbd_6dc3ef53bf4e5cba2022-12-01 · +4dVerified
Indiana State AGbd_c170f4c8f55ad7922022-12-01 · +4dVerified

Show 2 more filings ↓up to 100d gap

Maine State AGbd_97c60aad9fad22ee2022-12-30 · +25dVerified
Maine State AGbd_ea86ace32dbbea5d2023-03-15 · +100dVerified

Name: Wing Financial Services
norm: wing financial

Name: Wing Financial Services
norm: wing financial
Industry: Professional Servicesllm

Discovered: —
Breach occurred: Aug 7, 2022
Materiality determined: —
Notification sent: Dec 1, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)Biometric
Data elements: Social Security numberDate of birthMedical information
Attack vector: Misconfiguration
Threat actor: External
Regulator citations: Notified Attorney General of New Hampshire
Initial access: exploit_public_facing

During the incident: Immediately began an internal investigation
Hired independent computer forensic experts
Immediately limited access to potentially affected servers
Began gathering evidence relating to the incident
Communicated with security and privacy professionals to analyze and mitigate any potential issues
Changed all of its user’s login credentials
Further trained its employees on securing information
Provided notice to all individuals whose information was in the system
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance
Changes made: Changed all of its user’s login credentials
Further trained its employees on securing information
Continually evaluate and modify practices and internal controls to enhance security and privacy
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Montana State AGDec 1 · first

Maine State AGDec 1 · first

Indiana State AGDec 1 · first

New Hampshire State AG+4d · this page

Massachusetts State AG+8d

Maine State AG+29d

Maine State AG+104d

Pattern: first filing Dec 1 (MT), last Mar 15 (ME) — a 104-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/wing-financial-services-20221205.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 5, 2022
Raw hash: 50f3932dc6ebe6699526fb85614b87df6340bc49cb8989cb3bf032c0f652d374

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityWing Financial Services

Victim entityWing Financial Services

IncidentMisconfiguration

Stated responseImmediately began an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov