HackingFinancial ServicesFinanceCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHighContained

ACADEMY MORTGAGE CORPORATION

bd_e304b68c35220b07 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 21, 2023

Filed

Dec 27, 2023

To disclose

40 weeks

Affected

17,083state residents only

Linked

11 filings

Confidence

65%

Full breach record for ACADEMY MORTGAGE CORPORATION →3 incidents on file

Academy Mortgage Corporation notified the Washington AG of a cybersecurity incident on March 21, 2023, where an unauthorized third party accessed systems. Affected data included names, SSNs, and DOBs for 17,083 Washington residents. Notifications were mailed December 20, 2023, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d40 weeks discovery → filing

Incident timeline

discovery → filing · 40 weeks / 281 days

Mar 21, 2023

Begins

Mar 21, 2023

Discovered

Dec 27, 2023

Filed

vs. sector median

+32 wks slower

This filing is one of 11 about the same incident.View merged incident

A leak claim by alphv about this victim predates this filing by 227 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitealphvbd_6ec09ae80601c3402023-05-14 · +227dVerified by operator

Regulatory filings (9) · sorted by filing gap

Montana State AGbd_3b5884dbff92d2bb2023-12-27Verified
Indiana State AGbd_230a4a729e72b2c72023-12-20 · +7dCandidate
New Hampshire State AGbd_73ec5e6957b4c72d2023-12-19 · +8dVerified
Oregon State AGbd_d76d3319b21c6f7b2024-01-05 · +9dVerified

Show 5 more filings ↓up to 19d gap

California State AGbd_e728b3b38da978092024-01-05 · +9dVerified
South Carolina State AGbd_9e37c4b7bf5d06f12024-01-08 · +12dVerified
Massachusetts State AGbd_2fd5bd42961ec23c2024-01-15 · +19dVerified
California State AGbd_7a0d1938864b9a742024-01-15 · +19dVerified
Maine State AGbd_a04b7d44352861c22024-01-15 · +19dVerified

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: ACADEMY MORTGAGE CORPORATION
norm: academy mortgage
Industry: Financial Servicesllm

Discovered: Mar 21, 2023
Breach occurred: Mar 21, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 20, 2023
Affected individuals: 17,083state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security numberDate of birth
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Washington Attorney General
Initial access: exploit_public_facing

During the incident: Conducted an investigation with the assistance of third-party forensic specialists
Engaging in steps to confirm the security of any relevant systems
Notified law enforcement
Wiped and rebuilt affected systems
Taken steps to bolster our network security
Changes made: Reviewing its safeguards relating to the security of its systems and servers
Reviewing and altering our policies, procedures, and network security software relating to the security of its systems
Offering Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing you with proactive fraud assistance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 40 weeks(281 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

New Hampshire State AGDec 19 · first

Indiana State AG+1d

Montana State AG+8d

Washington State AG+8d · this page

Oregon State AG+17d

California State AG+17d

South Carolina State AG+20d

Massachusetts State AG+27d

California State AG+27d

Maine State AG+27d

Pattern: first filing Dec 19 (NH), last Jan 15 (ME) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16247.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 27, 2023
Raw hash: 78aed82f70b677e191e0a672a7c77cc56637628bf0cb3c44a949c60284ac4884

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityACADEMY MORTGAGE CORPORATION

Incidentdiscovered Mar 21, 2023

Stated responseConducted an investigation with the assistance of third-party forensic specialists

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com