Social EngineeringTechnologyInformationPhishingStolen CredentialsCustomer Data InvolvedIdentity (basic)LowContained

StaffScapes, Inc

bd_e0db96675de4aaf2 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 3, 2023

Filed

Apr 25, 2023

To disclose

8 weeks

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for StaffScapes, Inc →

StaffScapes, Inc. notified Montana residents of an email compromise incident occurring on or about February 15, 2023, discovered on March 3, 2023. An unknown third party gained unauthorized access, potentially exposing names and other personal information. StaffScapes engaged forensic consultants, reset passwords, and reinforced MFA. Affected individuals were offered 24 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 16 days

discovery → filing · 8 weeks / 53 days

Feb 15, 2023

Begins

Mar 3, 2023

Discovered

Apr 25, 2023

Filed

vs. sector median

11 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_0ec5eb0a02773f572023-04-25Verified
Massachusetts State AGbd_984f521c0e7e47ea2023-04-25Verified
Maine State AGbd_d7964060eccf71da2023-04-25Candidate

Name: StaffScapes, Inc
norm: staffscapes
Domain: staffscapes.com

Name: StaffScapes, Inc
norm: staffscapes
Domain: staffscapes.com
Industry: Technologyllm

Discovered: Mar 3, 2023
Breach occurred: Feb 15, 2023
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 25, 2023
Affected individuals: 2state-resident count only
Data types: Identity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Initial access: phishing_link

During the incident: Engaged forensic consultants to investigate the root of incident
Secured its systems
Initiated an investigation into the unauthorized access
Mass password resets
Reinforced two-factor authentication
Changes made: Reinforced two-factor authentication
Mass password resets
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGApr 25 · first

Massachusetts State AGApr 25 · first

Maine State AGApr 25 · first

Montana State AGApr 25 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-215.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 25, 2023
Raw hash: 49ce9ece86f715c1e7b24aba803f834193e830ae38cc4260ce64f37cd3ff6b81

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityStaffScapes, Inc

Victim entityStaffScapes, Inc

Incidentdiscovered Mar 3, 2023

Stated responseEngaged forensic consultants to investigate the root of incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov