Social EngineeringFinancial ServicesFinancePhishingSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

RBC Wealth Management

bd_fb8c4a8df872a4e3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 18, 2018

Filed

Aug 3, 2018

To disclose

16 days

Affected

6state residents only

Linked

2 filings

Confidence

67%

Full breach record for RBC Wealth Management →3 incidents on file

RBC Wealth Management notified the NH AG of a phishing attack targeting a third-party vendor (Supernova Lending LLC) employee's email account on July 18, 2018. The incident exposed PII (names, DOB, SSN, driver's license, passport) of 6 NH residents. RBC offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 days

Jul 18, 2018

Discovered

Aug 3, 2018

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Oregon State AGbd_42f9fd305df82d612018-08-09 · +6dVerified

Name: RBC Wealth Management
norm: rbc wealth management
Domain: rbcwealthmanagement.com

Name: RBC Wealth Management
norm: rbc wealth management
Domain: rbcwealthmanagement.com
Industry: Financial Servicesllm

Discovered: Jul 18, 2018
Materiality determined: —
Notification sent: Aug 8, 2018
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government ID
Data elements: Date of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: phishing_link

During the incident: Blocked attacker access to the affected environment
Remediated impacted accounts
Implemented additional measures to enhance the general security of the environment
Offered affected clients complimentary credit monitoring for twelve (12) months through Identity Guard
Provided a Client Support Services toll free number for additional questions
Implemented enhanced fraud monitoring
Changes made: Implemented additional measures to enhance the general security of the environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGAug 3 · first · this page

Oregon State AG+6d

Pattern: first filing Aug 3 (NH), last Aug 9 (OR) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/rbc-wealth-management-20180803.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 3, 2018
Raw hash: ec9880be81c51b342488b3a352c399d2af0303de22fd2d38bb07de940cffc68f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityRBC Wealth Management

Victim entityRBC Wealth Management

Incidentdiscovered Jul 18, 2018

Stated responseBlocked attacker access to the affected environment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov