HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDMediumContained

North American Risk Services, Inc.

bd_ec8112310f8de5ed · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 27, 2018

Filed

Oct 5, 2018

To disclose

14 weeks

Affected

2state residents only

Confidence

66%

North American Risk Services, Inc. reported unauthorized access to employee email accounts from Feb 7 to Mar 27, 2018. The breach exposed names and SSNs of 2 Montana residents. NARS confirmed the breach on June 27, 2018, engaged forensic investigators, and began notifying affected individuals on Aug 31, 2018, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 140 days

discovery → filing · 14 weeks / 100 days

Feb 7, 2018

Begins

Jun 27, 2018

Discovered

Oct 5, 2018

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: North American Risk Services, Inc.
norm: north american risk services

Name: North American Risk Services, Inc.
norm: north american risk services
Industry: Professional Servicesllm

Discovered: Jun 27, 2018
Breach occurred: Feb 7, 2018 – Mar 27, 2018
Undetected for: 140 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 31, 2018
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: providing notice to other state regulators
Initial access: valid_credentials

During the incident: Launched an investigation, with the assistance of a third party forensic investigator
Offering individuals impacted by this event with access to one (1) year of complimentary credit monitoring and identity restoration services
Providing potentially impacted individuals with guidance on how to better protect against identity theft and fraud
Providing notice to other state regulators and the consumer reporting agencies
Changes made: Reviewing its policies and procedures
Implementing additional email security mechanisms
Implementing additional safeguards and employee training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(100 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/North-American-Risk-Services-1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 5, 2018
Raw hash: f3dfb2ec9e105e589bed52de8ff1bdfec7e5c0f12cf7738b0eb8199562dfcdad

Reporting entityNorth American Risk Services, Inc.

Victim entityNorth American Risk Services, Inc.

Incidentdiscovered Jun 27, 2018

Stated responseLaunched an investigation, with the assistance of a third party forensic investigator

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov