HackingFinancial ServicesFinanceEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDMediumResolved

ACADEMY MORTGAGE CORPORATION

bd_e728b3b38da97809 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 21, 2023

Filed

Jan 5, 2024

To disclose

41 weeks

Affected

Not disclosed

Linked

11 filings

Confidence

64%

Full breach record for ACADEMY MORTGAGE CORPORATION →3 incidents on file

Academy Mortgage Corporation detected a network security incident on March 21, 2023, where an unauthorized third party accessed and disabled systems. The investigation concluded in November 2023, determining that personal information (names, SSNs, dates of birth) of current/former employees and mortgage applicants may have been accessed. No evidence of misuse was found. The company engaged forensic specialists, notified law enforcement, rebuilt systems, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 21, 2023 → Notified Dec 20, 2023274d ✗ CA 60-day late41 weeks discovery → filing

Incident timeline

discovery → filing · 41 weeks / 290 days

Mar 21, 2023

Begins

Mar 21, 2023

Discovered

Jan 5, 2024

Filed

vs. sector median

+33 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitealphvbd_6ec09ae80601c3402023-05-14 · +236dVerified by operator

Regulatory filings (9) · sorted by filing gap

Oregon State AGbd_d76d3319b21c6f7b2024-01-05Verified
South Carolina State AGbd_9e37c4b7bf5d06f12024-01-08 · +3dVerified
Montana State AGbd_3b5884dbff92d2bb2023-12-27 · +9dVerified
Washington State AGbd_e304b68c35220b072023-12-27 · +9dVerified

Show 5 more filings ↓up to 17d gap

Massachusetts State AGbd_2fd5bd42961ec23c2024-01-15 · +10dVerified
California State AGbd_7a0d1938864b9a742024-01-15 · +10dVerified
Maine State AGbd_a04b7d44352861c22024-01-15 · +10dVerified
Indiana State AGbd_230a4a729e72b2c72023-12-20 · +16dCandidate
New Hampshire State AGbd_73ec5e6957b4c72d2023-12-19 · +17dVerified

Name: ACADEMY MORTGAGE CORPORATION
norm: academy mortgage

Name: ACADEMY MORTGAGE CORPORATION
norm: academy mortgage
Industry: Financial Servicesllm

Discovered: Mar 21, 2023
Breach occurred: Mar 21, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 20, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
Threat actor: External

During the incident: Engaged third-party forensic specialists to assist with securing the network environment and investigating the extent of any unauthorized activity
Notified law enforcement
Wiped and rebuilt affected systems
Taken steps to bolster network security
Offering Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Changes made: Reviewing and altering policies, procedures, and network security software relating to the security of our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(290 days from discovery to filing)
Compliance flags: CA 60-day late · 274dLeak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 21, 2023
→ Notified: Dec 20, 2023
274d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 21, 2023 → Notified: Dec 20, 2023	274d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

New Hampshire State AGDec 19 · first

Indiana State AG+1d

Montana State AG+8d

Washington State AG+8d

Oregon State AG+17d

California State AG+17d · this page

South Carolina State AG+20d

Massachusetts State AG+27d

California State AG+27d

Maine State AG+27d

Pattern: first filing Dec 19 (NH), last Jan 15 (ME) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-578941
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 5, 2024
Raw hash: 41580c2f55e4ac709c396f8688d55676d5b2480bd5015d7dc600fcb35708d9ed

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityACADEMY MORTGAGE CORPORATION

Victim entityACADEMY MORTGAGE CORPORATION

Incidentdiscovered Mar 21, 2023

Stated responseEngaged third-party forensic specialists to assist with securing the network environment and investigating the extent of any unauthorized activity

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov