Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsData ExfiltratedTargetedIdentity (basic)MediumContained

North American Risk Services, Inc.

bd_fa4de3d6a97e9dc6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 7, 2018

Filed

Oct 9, 2018

To disclose

35 weeks

Affected

1,050state residents only

Linked

6 filings

Confidence

64%

Full breach record for North American Risk Services, Inc. →

North American Risk Services, Inc. notified individuals of a data breach where employee email accounts were compromised via phishing between Feb 7 and Mar 27, 2018. Names were accessible. NARS engaged forensic investigators and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due35 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 35 weeks / 244 days

Feb 7, 2018

Begins

Feb 7, 2018

Discovered

Oct 9, 2018

Filed

vs. sector median

+26 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_88f49ea522ae2d6a2018-10-09Verified
Montana State AGbd_292ab78179daee912018-10-05 · +4dVerified
Massachusetts State AGbd_9b7589c09a5277992018-10-05 · +4dCandidate
California State AGbd_bad34ba23c2fe5762018-10-05 · +4dVerified

Show 1 more filing ↓up to 39d gap

Massachusetts State AGbd_bd1e0ea0cb07db1a2018-08-31 · +39dCandidate

Name: North American Risk Services, Inc.
norm: north american risk

Name: North American Risk Services, Inc.
norm: north american risk
Industry: Financial Servicesllm

Discovered: Feb 7, 2018
Breach occurred: Feb 7, 2018 – Mar 27, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 3, 2018
Affected individuals: 1,050state-resident count only
Data types: Identity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Launched an investigation, with the assistance of a third party forensic investigator
Undertook an extensive search of its internal records
A third-party vendor was retained to locate the missing addresses
Offering you access to 12 months of credit monitoring and identity theft restoration services at no cost to you through Epiq
Arranged for you to enroll, at no cost to you, in an online, three-bureau credit monitoring service
Changes made: Working to implement additional safeguards and employee training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(244 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Massachusetts State AGAug 31 · first

Montana State AG+35d

Massachusetts State AG+35d

California State AG+35d

New Hampshire State AG+39d

South Carolina State AG+39d · this page

Pattern: first filing Aug 31 (MA), last Oct 9 (SC) — a 39-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/NorthAmericanRiskServicesInc..pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 9, 2018
Raw hash: e8be16bc44e132ab8520d5a5d9ba321f27f8a9ce151ae88d4dacc83b2bafe003

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityNorth American Risk Services, Inc.

Victim entityNorth American Risk Services, Inc.

Incidentdiscovered Feb 7, 2018

Stated responseLaunched an investigation, with the assistance of a third party forensic investigator

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov