HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)LowContained

Kovack Financial

bd_eb5b3cc05bb2aae0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 5, 2023

Filed

Jul 9, 2024

To disclose

44 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for Kovack Financial →3 incidents on file

Kovack Financial reported that an unauthorized party gained access to certain email accounts. The company learned of the incident on September 5, 2023. Investigation revealed that files containing personal information (full name) may have been accessed and acquired between August 15, 2023, and September 5, 2023. The company engaged external cybersecurity professionals and is offering identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 21 days

discovery → filing · 44 weeks / 308 days

Aug 15, 2023

Begins

Sep 5, 2023

Discovered

Jul 9, 2024

Filed

vs. sector median

+36 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Vermont State AGbd_2a525a9c969a58502024-07-09Verified
Maine State AGbd_f10e23eeb8cf539f2024-07-09Verified
Massachusetts State AGbd_99adcfc3d6ea41fd2024-07-10 · +1dVerified

Name: Kovack Financial
norm: kovack financial

Name: Kovack Financial
norm: kovack financial
Industry: Financial Servicesllm

Discovered: Sep 5, 2023
Breach occurred: Aug 15, 2023 – Sep 5, 2023
Undetected for: 21 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals experienced in handling these types of issues
Offering CyEx Identity Defense services
Changes made: Continually evaluate and modify our practices and internal controls to enhance the security and privacy of your personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 44 weeks(308 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Vermont State AGJul 9 · first

Maine State AGJul 9 · first

California State AGJul 9 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-588298
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 9, 2024
Raw hash: 415ea71fa130f1f956a885be288b85c381ae8d58d6a35f29e76f16685334fc15

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityKovack Financial

Victim entityKovack Financial

Incidentdiscovered Sep 5, 2023

Stated responseCommenced a prompt and thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov