HackingFinancial ServicesTechnologyFinanceStolen CredentialsData ExfiltratedData PublishedTargetedGovernment IDIdentity (basic)MediumActive

Chicago Trading Company

bd_f5ba0ed0b1b1e2e5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 27, 2023

Filed

Nov 16, 2023

To disclose

20 days

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for Chicago Trading Company →

Chicago Trading Company notified Montana residents of a cybersecurity incident on October 27, 2023, where a criminal gained unauthorized access to corporate systems. The attacker stole PII including SSNs, birth dates, addresses, passport info, and driver's license info. CTC is cooperating with law enforcement and offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 20 days

Oct 27, 2023

Begins

Oct 27, 2023

Discovered

Nov 16, 2023

Filed

vs. sector median

6 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_b6ba9019744df8bc2023-11-17 · +1dVerified by operator

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_cc1191d8b92a85222023-11-16Verified
Illinois State AGbd_b34b7328faf2c98d2023-01-01 · +319dVerified by operator

Name: Chicago Trading Company
norm: chicago trading
Domain: chicagotrading.com

Name: Chicago Trading Company
norm: chicago trading
Domain: chicagotrading.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Oct 27, 2023
Breach occurred: Oct 27, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Full cooperation with law enforcement
Initial access: valid_credentials

During the incident: Worked with an external forensic investigation firm
Cooperation with law enforcement
Conducting a comprehensive review and audit of security policies
Patching policies
Implementing additional advanced security measures
Providing complimentary 24-month credit monitoring service through Equifax
Changes made: Conducting a comprehensive review and audit of security policies
Patching policies
Implementing additional advanced security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Illinois State AGJan 1 · first

Massachusetts State AG+319d

Montana State AG+319d · this page

Pattern: first filing Jan 1 (IL), last Nov 16 (MT) — a 319-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-858.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 16, 2023
Raw hash: 644a9ea814badd64b29cbc85f5d4f4a06c4470c5d3dac15ce91402c3bc63f60b

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityChicago Trading Company

Victim entityChicago Trading Company

Incidentdiscovered Oct 27, 2023

Stated responseWorked with an external forensic investigation firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov