HackingFinancial ServicesFinanceStolen CredentialsTargetedIdentity (basic)Government IDMediumContained

Clements Financial Services

bd_e4f87238c0f75ab7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 9, 2020

Filed

Mar 25, 2021

To disclose

37 weeks

Affected

2state residents only

Linked

2 filings

Confidence

66%

Full breach record for Clements Financial Services →

Clements Financial Services notified clients of unauthorized access to its network and tax filing software between June 11 and July 9, 2020. The incident involved potential unauthorized access to names and Social Security numbers. The company investigated, implemented safeguards, notified the IRS, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 28 days

discovery → filing · 37 weeks / 259 days

Jun 11, 2020

Begins

Jul 9, 2020

Discovered

Mar 25, 2021

Filed

vs. sector median

+28 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_3ca3b4b35aa6132b2021-03-25Verified

Name: Clements Financial Services
norm: clements financial

Name: Clements Financial Services
norm: clements financial
Industry: Financial Servicesllm

Discovered: Jul 9, 2020
Breach occurred: Jun 11, 2020 – Jul 9, 2020
Undetected for: 28 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified and is working with the Internal Revenue Service (IRS)
Initial access: valid_credentials

During the incident: Launched an investigation to determine the nature and scope of the activity
Reviewed existing privacy policy
Implemented additional safeguards to enhance the security of information
Notified and is working with the Internal Revenue Service (IRS)
Offering twelve (12) months of complimentary credit monitoring services through TransUnion Interactive
Changes made: Reviewed existing privacy policy
Implemented additional safeguards to enhance the security of information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 37 weeks(259 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMar 25 · first

Montana State AGMar 25 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/clemmySamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 25, 2021
Raw hash: f62f7c6d8deee7e26e5be3b500aaed911514e5bbfe614ab889d625a883558591

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityClements Financial Services

Victim entityClements Financial Services

Incidentdiscovered Jul 9, 2020

Stated responseLaunched an investigation to determine the nature and scope of the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov