HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentMediumContained

Voya Financial Advisors, Inc.

bd_ed198ddb056bd870 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 13, 2016

Filed

Apr 21, 2016

To disclose

8 days

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Voya Financial Advisors, Inc. →3 incidents on file

Voya Financial Advisors, Inc. disclosed that perpetrators used a financial advisor's stolen personal information to gain unauthorized access to VFA's systems and client records on or shortly after April 13, 2016. The incident involved potential exposure of names, addresses, dates of birth, partial SSNs, government IDs, employer info, and financial account details. VFA detected and remediated the access within hours, notified the FBI, and offered one year of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 13, 2016 → Notified Apr 21, 20168d ✓ CA 60-day OK8 days discovery → filing

Incident timeline

discovery → filing · 8 days

Apr 13, 2016

Begins

Apr 13, 2016

Discovered

Apr 21, 2016

Filed

vs. sector median

7 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_d82c24edcec860812016-04-20 · +1dVerified

Name: Voya Financial Advisors, Inc.
norm: voya financial advisors

Name: Voya Financial Advisors, Inc.
norm: voya financial advisors
Industry: Financial Servicesllm

Discovered: Apr 13, 2016
Breach occurred: Apr 13, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 21, 2016
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountEmployment
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the FBI
Initial access: valid_credentials

During the incident: Detected and remediated the unauthorized access within a matter of hours
Actively investigating this matter
Implemented additional measures to safeguard against similar, unauthorized access to its systems
Providing one year of FREE credit monitoring and identity fraud coverage through Equifax Personal Solutions
Changes made: Implemented additional measures to safeguard against similar, unauthorized access to its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 days(8 days from discovery to filing)
Compliance flags: CA 60-day OK · 8d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 13, 2016
→ Notified: Apr 21, 2016
8d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 13, 2016 → Notified: Apr 21, 2016	8d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGApr 20 · first

California State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-61193
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 21, 2016
Raw hash: 318aec28aaae31c669068f8a62b7f930f296dad9861fd8a24de0d988a9189cb1

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityVoya Financial Advisors, Inc.

Victim entityVoya Financial Advisors, Inc.

Incidentdiscovered Apr 13, 2016

Stated responseDetected and remediated the unauthorized access within a matter of hours

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov