MalwareFinancial ServicesFinanceRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedFinancial accountIdentity (basic)MediumContained

CARRINGTON MORTGAGE SERVICES, LLC

bd_f8d0fbd186b2419f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 10, 2023

Filed

Apr 26, 2023

To disclose

7 weeks

Affected

5,032state residents only

Linked

3 filings

Confidence

70%

Full breach record for CARRINGTON MORTGAGE SERVICES, LLC →

Carrington Mortgage Services, LLC reported a ransomware attack affecting customer workforce management and dialer data. The incident occurred March 9-10, 2023, and was discovered on March 10, 2023. Approximately 5,032 Washington residents were affected. Personal information including names was involved. Carrington engaged forensic experts, notified the FBI, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d7 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 1 days

discovery → filing · 7 weeks / 47 days

Mar 9, 2023

Begins

Mar 10, 2023

Discovered

Apr 26, 2023

Filed

vs. sector median

3 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_e2872449ccf1a23f2023-04-26Verified
Illinois State AGbd_0f61a1c5d75d4a072023-01-01 · +115dCandidate

Name: CARRINGTON MORTGAGE SERVICES, LLC
norm: carrington mortgage

Name: CARRINGTON MORTGAGE SERVICES, LLC
norm: carrington mortgage
Industry: Financial Servicesllm

Discovered: Mar 10, 2023
Breach occurred: Mar 9, 2023 – Mar 10, 2023
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Apr 26, 2023
Affected individuals: 5,032state-resident count only
Data types: Identity (basic)
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the Federal Bureau of Investigation ("FBI")

During the incident: Secured networks
Safely restored systems and operations via viable backups
Initiated an investigation of the incident with the assistance of forensic experts
Notified the Federal Bureau of Investigation ("FBI")
Providing access to 24 months of credit monitoring and identity restoration services through Experian
Changes made: Implemented measures to further improve the security of the systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(47 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Illinois State AGJan 1 · first

Massachusetts State AG+115d

Washington State AG+115d · this page

Pattern: first filing Jan 1 (IL), last Apr 26 (WA) — a 115-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA22905.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 26, 2023
Raw hash: 593c8aa5a432871dafb8e43ad50c3b49cc2b3b81a1a004ff442fdc35a990a3a6

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCARRINGTON MORTGAGE SERVICES, LLC

Victim entityCARRINGTON MORTGAGE SERVICES, LLC

Incidentdiscovered Mar 10, 2023

Stated responseSecured networks

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com