HackingFinancial ServicesProfessional ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentMinorMediumContained

GFS

bd_e34e73f5b176fa0c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 20, 2019

Filed

Nov 13, 2019

To disclose

12 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for GFS →

GFS, Inc. experienced unauthorized access to an office computer between August 13 and August 22, 2019, discovered on August 20, 2019. An external actor accessed tax filing software and a financial advisor portal (HDV Link/Avantax), downloading documents containing names, addresses, SSNs, wage/salary info, financial account info, and dates of birth. In one instance, a fraudulent tax return was filed. GFS engaged forensic investigators, notified the IRS, and offered credit/identity monitoring to affected individuals, including minors.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

discovery → filing · 12 weeks / 85 days

Aug 13, 2019

Begins

Aug 20, 2019

Discovered

Nov 13, 2019

Filed

vs. sector median

+4 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: GFS
norm: gfs
Domain: gfsinc.net

Name: GFS
norm: gfs
Domain: gfsinc.net
Industry: Financial ServicesllmProfessional Servicesllm

Discovered: Aug 20, 2019
Breach occurred: Aug 13, 2019 – Aug 22, 2019
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountEmploymentMinor
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported this incident to the IRSReporting this incident to other appropriate government regulators as required by law

During the incident: Launched an investigation
Engaged a third-party computer forensic investigator
Reported this incident to the IRS
Providing access to credit monitoring and identity protection services from TransUnion
Providing access to child identity monitoring through Equifax
Changes made: Working to implement additional safeguards to better protect against unauthorized access to our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(85 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-184304
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 13, 2019
Raw hash: 5bbe344584d3bce011f065b2a453d779ca3a5098b0ceddf68a7e0d6130bb01f1

Reporting entityGFS

Victim entityGFS

Incidentdiscovered Aug 20, 2019

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov