HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Servis One, Inc.

bd_e2fbb634a90b7776 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Sep 27, 2017

To disclose

—

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for Servis One, Inc. →2 incidents on file

BSI Financial Services (Servis One, Inc.) notified the California AG of a data security incident on June 1, 2017. An unauthorized third party illegally gained access to one employee's business email account. The attacker used the employee's credentials to send emails to others. Affected data may include borrower names, addresses, and account numbers. The company disabled the account, engaged forensic investigators, notified law enforcement, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 1, 2017

Begins

Sep 27, 2017

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_68d65420a6f6eef62017-09-29 · +2dVerified
Oregon State AGbd_9a00a47170115d2e2017-09-29 · +2dCandidate
Washington State AGbd_f5d5efd2eaf0fdc22017-09-29 · +2dVerified
Massachusetts State AGbd_1d30ef40807cb4f02017-10-04 · +7dVerified

Name: Servis One, Inc.
norm: servis one

Name: Servis One, Inc.
norm: servis one
Also named: Servis One, Inc.dba oflegal entity
BSI Financial Servicesdba oftrade name
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Jun 1, 2017
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Reported this security incident to law enforcement

During the incident: Disabled this employee's business email account
Further strengthened the security of our email systems
Began working with a nationally-recognized computer forensics investigation firm to determine what happened and what information may have been compromised
Reported this security incident to law enforcement
Advised the three major consumer reporting agencies (Equifax, Experian, and TransUnion) about this incident
Retained Experian to provide you with credit monitoring and identity theft restoration services, at no charge to you
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGSep 27 · first · this page

Montana State AG+2d

Oregon State AG+2d

Washington State AG+2d

Massachusetts State AG+7d

Pattern: first filing Sep 27 (CA), last Oct 4 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-102180
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 27, 2017
Raw hash: 49fd828f4dd68993b6709ca146f7e67465b7ddc012d39bfc996cbac943edd87e

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityServis One, Inc.

Victim entityServis One, Inc.

IncidentUnauthorized Access

Stated responseDisabled this employee's business email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov