HackingVulnerability ExploitZero-DaySupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICFINANCIALEMPLOYMENTLowContained
Lobel Financial
bd_dfd6af56640a2e39 · schema v1 · pii pii-v1
Full breach record for Lobel Financial →Lobel Financial Corporation notified customers that a supplier of its funding partner, JPMorgan Chase Bank, N.A., named CBIZ, was impacted by the MOVEit zero-day vulnerability. The incident occurred on or about May 30, 2023, and was discovered on May 31, 2023. Affected data included names, dates of birth, ages, FICO scores, employment information, and vehicle data. Social security numbers were not involved. CBIZ shut down the affected FTP site and patched the server. JPMorgan is evaluating additional preventative measures.
California clockDiscovered May 31, 2023 → Notified Nov 6, 2023159d ✗ CA 60-day late23 weeks discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_bbe0901dbf97925aVermont State AGfiled 2023-11-06(3d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-576333
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 9, 2023
- Raw hash
- e1454c57e1c4963558b8b2842b6ae5fd3894602a8a9a903df06c364c2a575162
Reporting entity
- Name
- Lobel Financialnorm: lobel financial
- Domain
- lobelfinancial.com
Victim entity
- Name
- Lobel Financialnorm: lobel financial
- Domain
- lobelfinancial.com
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- Nov 6, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICFINANCIALEMPLOYMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
- Threat actor
- External
- Third party
- via CBIZJPMorgan Chase Bank, N.A. supplier
- Initial access
- supply_chain
Compliance
- Time to disclose
- 23 weeks(162 days from discovery to filing)
- Compliance flags
- CA 60-day late · 159d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: May 31, 2023→ Notified: Nov 6, 2023159d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.