UnknownFinancial ServicesFinanceCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Novation Settlement Solutions

bd_e3da30d5b9626101 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 29, 2016

Filed

Sep 26, 2016

To disclose

28 days

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Novation Settlement Solutions →

Novation Settlement Solutions notified California residents that an unidentified third party likely possessed files containing names, dates of birth, addresses, phone numbers, Social Security numbers, and some financial account numbers. The company learned of the incident in late August 2016 and determined the scope on September 8, 2016. No evidence of misuse was found. Novation offered one year of complimentary identity monitoring through Kroll and implemented additional security controls and training.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 29, 2016 → Notified Sep 8, 201610d ✓ CA 60-day OK28 days discovery → filing

Incident timeline

discovery → filing · 28 days

Aug 29, 2016

Discovered

Sep 26, 2016

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_ae137c6a3f1bfe872016-09-23 · +3dCandidate
Massachusetts State AGbd_07d1bb630a227d9d2016-09-30 · +4dVerified

Name: Novation Settlement Solutions
norm: novation settlement

Name: Novation Settlement Solutions
norm: novation settlement
Industry: Financial Servicesllm

Discovered: Aug 29, 2016
Materiality determined: —
Notification sent: Sep 8, 2016
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Date of birth
Attack vector: Unknown
Threat actor: External

During the incident: Initiated a fact-gathering process
Secured the services of Kroll to provide identity monitoring at no cost for one year
Set up a customer call center to handle questions related to this incident
Changes made: Implement any additional security controls that are needed
Review and update privacy and security policies as appropriate
Ensure personnel are properly trained in information privacy and security practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: CA 60-day OK · 10d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 29, 2016
→ Notified: Sep 8, 2016
10d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 29, 2016 → Notified: Sep 8, 2016	10d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGSep 23 · first

California State AG+3d · this page

Massachusetts State AG+7d

Pattern: first filing Sep 23 (MT), last Sep 30 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-64028
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 26, 2016
Raw hash: 76a11d4e38038c4bf6597e28175bd002d3448573f9a84392f5cde211bcadf8a6

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNovation Settlement Solutions

Victim entityNovation Settlement Solutions

Incidentdiscovered Aug 29, 2016

Stated responseInitiated a fact-gathering process

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov