The Maine Office of the Attorney General disclosed a data breach at **Charles Schwab & Co., Inc.** on **June 8, 2023**, stemming from **insider wrongdoing** discovered on **April 19, 2023**. The incident compromised sensitive personal data, including **driver’s license numbers**, affecting **774 individuals**, of which **4 were Maine residents**. The breach involved unauthorized access or misuse of internal systems by an employee or trusted insider, leading to the exposure of personally identifiable information (PII). While the exact scope of the stolen data beyond driver’s license numbers remains undisclosed, such breaches typically heighten risks of **identity theft, financial fraud, or targeted phishing attacks** against victims. The company likely faced regulatory scrutiny, potential legal liabilities, and reputational damage due to the failure to prevent insider threats. Insider-driven breaches are particularly concerning as they exploit **legitimate access privileges**, bypassing traditional cybersecurity defenses. The incident underscores vulnerabilities in **internal controls, monitoring, and employee vetting processes**, which are critical for financial institutions handling high-value client data. No evidence suggests ransomware or external cyberattacks were involved, focusing the blame solely on **internal malfeasance**.
TPRM report: https://www.rankiteo.com/company/charles-schwab
"id": "cha040091825",
"linkid": "charles-schwab",
"type": "Breach",
"date": "3/2023",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"{'affected_entities': [{'customers_affected': '774 individuals (including 4 '
'Maine residents)',
'industry': 'Investment Brokerage',
'location': 'United States',
'name': 'Charles Schwab & Co., Inc.',
'type': 'Financial Services'}],
'attack_vector': 'Insider Wrongdoing',
'data_breach': {'number_of_records_exposed': '774',
'personally_identifiable_information': True,
'sensitivity_of_data': 'High (includes government-issued IDs)',
'type_of_data_compromised': ['Driver’s license numbers',
'Personal data']},
'date_detected': '2023-04-19',
'date_publicly_disclosed': '2023-06-08',
'description': 'The Maine Office of the Attorney General reported a data '
'breach involving Charles Schwab & Co., Inc. The breach, which '
'involved insider wrongdoing, was discovered on April 19, '
'2023, and potentially affected 774 individuals, including 4 '
'residents of Maine. Information compromised includes driver’s '
'license numbers among other personal data.',
'impact': {'brand_reputation_impact': 'Potential reputational harm due to '
'insider breach and exposure of '
'sensitive personal data',
'data_compromised': ['Driver’s license numbers',
'Other personal data'],
'identity_theft_risk': 'High (due to exposure of driver’s license '
'numbers and personal data)'},
'investigation_status': 'Disclosed; ongoing or closed status unclear',
'post_incident_analysis': {'root_causes': 'Insider wrongdoing (intentional or '
'negligent misuse of access)'},
'references': [{'date_accessed': '2023-06-08',
'source': 'Maine Office of the Attorney General'}],
'regulatory_compliance': {'regulatory_notifications': 'Maine Office of the '
'Attorney General'},
'response': {'communication_strategy': 'Public disclosure via Maine Attorney '
'General’s office'},
'threat_actor': 'Insider (Employee/Associate)',
'title': 'Charles Schwab & Co., Inc. Data Breach via Insider Wrongdoing',
'type': 'Data Breach (Insider Threat)'}