HackingFinancial ServicesTechnologyFinanceVulnerability ExploitCustomer Data InvolvedPIICredentialsLowContained

CUSO Financial Services, L.P.

bd_efcb6767e0e2d826 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 20, 2023

Filed

Feb 16, 2024

To disclose

17 weeks

Affected

1state residents only

Linked

7 filings

Confidence

66%

Full breach record for CUSO Financial Services, L.P. →5 incidents on file

CUSO Financial Services, LP notified New Hampshire residents of a security event discovered on October 20, 2023, involving a vulnerability in Barracuda Networks email application. Unauthorized access to historical emails and attachments dating back to July 5, 2022, was possible. One New Hampshire resident was affected. CFS reported the incident to federal law enforcement and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 472 days

discovery → filing · 17 weeks / 119 days

Jul 5, 2022

Begins

Oct 20, 2023

Discovered

Feb 16, 2024

Filed

vs. sector median

+9 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_07db9bec418ab63b2024-02-16Verified
Vermont State AGbd_4ed0f902278f502d2024-02-16Verified by operator
Indiana State AGbd_5e7d3bbb2432fd7d2024-02-16Verified
California State AGbd_7dfd4f2b42eb5c012024-02-16Verified

Show 2 more filings ↓

Montana State AGbd_8322500873ed6ac42024-02-16Verified
Maine State AGbd_9c6021565739f1562024-02-16Verified

Name: CUSO Financial Services, L.P.
norm: cuso financial

Name: CUSO Financial Services, L.P.
norm: cuso financial
Industry: Financial ServicesllmTechnologyllm

Discovered: Oct 20, 2023
Breach occurred: Jul 5, 2022
Undetected for: 472 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 16, 2024
Affected individuals: 1state-resident count only
Data types: PIICredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: reported to federal law enforcementproviding written notice of this event to appropriate state regulators
Initial access: exploit_public_facing

During the incident: Moved quickly to investigate, respond, and identify potentially affected individuals
Confirming that the vulnerability was closed and that no additional data was at risk
Assessed any potentially impacted accounts to notify affected individuals
Reported to federal law enforcement
Changes made: Offering access to credit monitoring and identity restoration services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(119 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Massachusetts State AGFeb 16 · first

Vermont State AGFeb 16 · first

Indiana State AGFeb 16 · first

California State AGFeb 16 · first

Montana State AGFeb 16 · first

Maine State AGFeb 16 · first

New Hampshire State AGFeb 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cuso-financial-services-20240216.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 16, 2024
Raw hash: b799648a2c9a2d4ce3c6b896bc4b111a5a7d908c02b0ce35a3a5d9938ed57dcb

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityCUSO Financial Services, L.P.

Victim entityCUSO Financial Services, L.P.

Incidentdiscovered Oct 20, 2023

Stated responseMoved quickly to investigate, respond, and identify potentially affected individuals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov