Social EngineeringTechnologyInformationPhishingCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Cartiga LLC

bd_f2d04854faf9b7c5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 20, 2023

Filed

Nov 6, 2023

To disclose

33 weeks

Affected

5state residents only

Linked

2 filings

Confidence

67%

Full breach record for Cartiga LLC →

Cartiga, LLC notified Montana residents of a data breach discovered on March 20, 2023, where a corporate laptop was compromised via phishing. Potentially affected data included names, addresses, DOB, SSNs, driver's license numbers, and health information. Cartiga investigated, implemented security safeguards, and provided 24 months of credit monitoring and identity theft protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 33 weeks / 231 days

Mar 20, 2023

Discovered

Nov 6, 2023

Filed

vs. sector median

+14 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_663f8c1ae0bc45c62023-11-06Verified

Name: Cartiga LLC
norm: cartiga

Name: Cartiga LLC
norm: cartiga
Industry: Technologyllm

Discovered: Mar 20, 2023
Materiality determined: —
Notification sent: —
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Conducted an investigation to understand which components of Cartiga’s systems were impacted
Conducting a thorough review of the potentially affected records
Implementing additional security measures, internal controls, and safeguards
Making changes to our policies and procedures to prevent a similar occurrence in the future
Providing 24 months of identity theft prevention and mitigation services, including credit monitoring at no cost
Changes made: Implementing additional security measures, internal controls, and safeguards
Making changes to our policies and procedures to prevent a similar occurrence in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(231 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGNov 6 · first

Montana State AGNov 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-822.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 6, 2023
Raw hash: 8ca4c3974e2904b838013efdaf26cd7fda97d7c246b3560af085d57786575cb9

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCartiga LLC

Victim entityCartiga LLC

Incidentdiscovered Mar 20, 2023

Stated responseConducted an investigation to understand which components of Cartiga’s systems were impacted

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov