HackingFinancial ServicesFinanceVulnerability ExploitZero-DaySupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)FinancialEmploymentLowContained

Lobel Financial

bd_dfd6af56640a2e39 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 31, 2023

Filed

Nov 9, 2023

To disclose

23 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Lobel Financial →

Lobel Financial Corporation notified customers that a supplier of its funding partner, JPMorgan Chase Bank, N.A., named CBIZ, was impacted by the MOVEit zero-day vulnerability. The incident occurred on or about May 30, 2023, and was discovered on May 31, 2023. Affected data included names, dates of birth, ages, FICO scores, employment information, and vehicle data. Social security numbers were not involved. CBIZ shut down the affected FTP site and patched the server. JPMorgan is evaluating additional preventative measures.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 31, 2023 → Notified Nov 6, 2023159d ✗ CA 60-day late23 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 23 weeks / 162 days

May 30, 2023

Begins

May 31, 2023

Discovered

Nov 9, 2023

Filed

vs. sector median

+15 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_e48664903e956e042023-11-09Verified
Vermont State AGbd_bbe0901dbf97925a2023-11-06 · +3dVerified

Name: Lobel Financial
norm: lobel financial
Domain: lobelfinancial.com

Name: Lobel Financial
norm: lobel financial
Domain: lobelfinancial.com
Industry: Financial Servicesllm

Discovered: May 31, 2023
Breach occurred: May 30, 2023
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Nov 6, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)FinancialEmployment
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
Threat actor: External
Third party: via CBIZJPMorgan Chase Bank, N.A. supplier
Initial access: supply_chain

During the incident: CBIZ shut down the FTP site
CBIZ began a forensic review
The impacted MOVEit server was restored to the last-known-good configuration
The impacted MOVEit server was patched before returning to production
JPMorgan is evaluating additional preventative measures and best practices to recommend to CBIZ
JPMorgan cyber security department is continuing to monitor the situation
Lobel is continuing to monitor the situation
Changes made: JPMorgan is evaluating additional preventative measures and best practices to recommend to CBIZ
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(162 days from discovery to filing)
Compliance flags: CA 60-day late · 159d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 31, 2023
→ Notified: Nov 6, 2023
159d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 31, 2023 → Notified: Nov 6, 2023	159d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Vermont State AGNov 6 · first

Massachusetts State AG+3d

California State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-576333
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 9, 2023
Raw hash: e1454c57e1c4963558b8b2842b6ae5fd3894602a8a9a903df06c364c2a575162

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityLobel Financial

Victim entityLobel Financial

Incidentdiscovered May 31, 2023

Stated responseCBIZ shut down the FTP site

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov