AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDCredentialsMediumResolved

CHARLES SCHWAB & CO., INC.

bd_fa7595d9df0ccd59 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 16, 2021

Filed

Mar 23, 2022

To disclose

14 weeks

Affected

17state residents only

Linked

6 filings

Confidence

66%

Full breach record for CHARLES SCHWAB & CO., INC. →31 incidents on file

Charles Schwab & Co., Inc. notified Montana residents that between May 18 and December 16, 2021, certain chat and email messages sent through Schwab.com were inadvertently sent to external email systems. Affected data included names, SSNs, tax IDs, driver's licenses, passport numbers, or usernames/passwords. Schwab remediated the issue, offers two years of credit monitoring via IdentityForce, and states there is no evidence of misuse.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 212 days

discovery → filing · 14 weeks / 97 days

May 18, 2021

Begins

Dec 16, 2021

Discovered

Mar 23, 2022

Filed

vs. sector median

+5 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_3f19b6e6e347a91c2022-03-23Candidate
Maine State AGbd_61155f67c4c7204a2022-03-23Verified
Indiana State AGbd_b253d38aa342fb412022-03-23Verified
Massachusetts State AGbd_1abb864ead347d592022-03-25 · +2dVerified

Show 1 more filing ↓up to 5d gap

New Hampshire State AGbd_94260cb23b33690a2022-03-28 · +5dVerified

Name: CHARLES SCHWAB & CO., INC.
norm: charles schwab
Domain: schwab.com

Name: CHARLES SCHWAB & CO., INC.
norm: charles schwab
Domain: schwab.com
Industry: Financial Servicesllm

Discovered: Dec 16, 2021
Breach occurred: May 18, 2021 – Dec 16, 2021
Undetected for: 212 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 17state-resident count only
Data types: Identity (basic)Government IDCredentials
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection

During the incident: Immediately remediated the issue
Worked to identify the information involved and who may be affected
Arranged for you to be able to enroll in credit monitoring and identity protection services from IdentityForce for two years at no cost to you
Continue to apply its multiple layers of security protections, including the 24/7 monitoring of our systems and client accounts for any signs of unusual activity
Changes made: Remediated the issue
Apply its multiple layers of security protections
24/7 Monitoring of our systems and client accounts for any signs of unusual activity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(97 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

California State AGMar 23 · first

Maine State AGMar 23 · first

Indiana State AGMar 23 · first

Montana State AGMar 23 · first · this page

Massachusetts State AG+2d

New Hampshire State AG+5d

Pattern: first filing Mar 23 (CA), last Mar 28 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-44.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 23, 2022
Raw hash: c96550a093fc8d17332d1d1baf1ab116881ab8ceafdc0057da06f967af5bb74e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCHARLES SCHWAB & CO., INC.

Victim entityCHARLES SCHWAB & CO., INC.

Incidentdiscovered Dec 16, 2021

Stated responseImmediately remediated the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov