PhysicalIdentity (basic)Government IDFinancial accountMediumActive

M Holdings Securities, Inc.

bd_efb4bbdc33642a3e · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Aug 31, 2016

To disclose

—

Affected

15state residents only

Linked

4 filings

Confidence

68%

M Holdings Securities, Inc. notified Montana residents that a company computer containing personal information (names, SSNs, driver's licenses, financial account numbers) was stolen from an employee's car. The device was password-protected. The company retained forensic investigators, offered 12 months of identity protection, and notified law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Aug 31, 2016

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Washington State AGbd_b707869c9dd462f92016-08-31Candidate
Massachusetts State AGbd_b04c465b20c2ffc92016-09-01 · +1dVerified
HHS OCRbd_ed57466eafcc0aa42016-09-01 · +1dVerified

Name: M Holdings Securities, Inc.
norm: m holdings securities

Name: M Holdings Securities, Inc.
norm: m holdings securities

Discovered: —
Materiality determined: —
Notification sent: —
Affected individuals: 15state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement

During the incident: Offering twelve months of complimentary identity protection services
Retaining a forensic investigator
Conducting a comprehensive review of our data security procedures
Employees participating in a security training program
Notified law enforcement
Changes made: Conducting a comprehensive review of our data security procedures
Employees participating in a security training program
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Washington State AGAug 31 · first

Montana State AGAug 31 · first · this page

Massachusetts State AG+1d

HHS OCR+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/M-Holdings-Securities.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 31, 2016
Raw hash: 3737411240da21a7c0dd46f93d79a206612ca2f4d4c57a3ada89f4e7cb241253

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityM Holdings Securities, Inc.

Victim entityM Holdings Securities, Inc.

IncidentUnauthorized Access

Stated responseOffering twelve months of complimentary identity protection services

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov