MalwareFinancial ServicesFinanceRansomwareData EncryptedData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Convergent Outsourcing, Inc.

bd_fd02da83dfcf0822 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 17, 2022

Filed

Oct 26, 2022

To disclose

19 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

65%

Full breach record for Convergent Outsourcing, Inc. →2 incidents on file

Convergent Outsourcing, Inc. notified individuals of a June 17, 2022 security incident involving ransomware deployment and unauthorized data access. The breach potentially exposed names, contact info, financial account numbers, and Social Security numbers. Convergent severed access, engaged third-party experts, reset passwords, and provided 12 months of credit monitoring. The incident impacted operations of affiliate Account Control Technology, Inc. Notification was sent October 26, 2022.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 19 weeks / 131 days

Jun 17, 2022

Discovered

Oct 26, 2022

Filed

vs. sector median

+10 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Indiana State AGbd_3163ae493bc0fe592022-10-26Verified
California State AGbd_408daf283b4aa0d62022-11-01 · +6dVerified
New Hampshire State AGbd_68ececae1b10f25d2022-11-01 · +6dVerified
Montana State AGbd_79fd3526dad02a412022-11-01 · +6dCandidate

Show 4 more filings ↓up to 14d gap

Maine State AGbd_7dfa3edfec6061222022-11-01 · +6dVerified
Washington State AGbd_406bbc06f61309b92022-11-02 · +7dVerified
Oregon State AGbd_6d39e9e1f55b0f2f2022-11-02 · +7dVerified
South Carolina State AGbd_60daea53419856bc2022-11-09 · +14dVerified

Name: Convergent Outsourcing, Inc.
norm: convergent outsourcing

Name: Convergent Outsourcing, Inc.
norm: convergent outsourcing
Industry: Financial Servicesllm

Discovered: Jun 17, 2022
Materiality determined: —
Notification sent: Oct 26, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Took action to secure our systems and isolated any impacted servers against additional spread
Severed the unauthorized actor’s access to our network and servers
Expanded our investigation to search for and review any personal information on our systems that could have been accessed
Proactively managed our network to sever connectivity and prevent the movement of the unauthorized actor
Reset all passwords
Engaged third-party experts to assist with containment, removal, and restoration
Coordinated with our clients and vendors to inform them of this event so they could deploy similar proactive measures on their own computer systems
Changes made: Deployed additional cybersecurity measures
Reviewed policies and procedures relating to data privacy and security to further harden our systems against future attacks
Providing you with twelve months of credit monitoring and identity protection services through IDX at no cost to you
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(131 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Indiana State AGOct 26 · first

Delaware State AGOct 26 · first · this page

California State AG+6d

New Hampshire State AG+6d

Montana State AG+6d

Maine State AG+6d

Washington State AG+7d

Oregon State AG+7d

South Carolina State AG+14d

Pattern: first filing Oct 26 (IN), last Nov 9 (SC) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2022/11/Convergent-Project-Wolf-FINAL-Gen-1-Individual-Notification-Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 26, 2022
Raw hash: 2547ec1d3ed19270bad08a05975884c319cda4acbda722677f54d09bc0f233a4

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityConvergent Outsourcing, Inc.

Victim entityConvergent Outsourcing, Inc.

Incidentdiscovered Jun 17, 2022

Stated responseTook action to secure our systems and isolated any impacted servers against additional spread

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov