Cyber Incident Victim: Pear Tree Advisors, Inc.
Date:
May 2023
Location:
United States of America
Summary
A cybersecurity incident involving an external system breach impacted Pear Tree Advisors, compromising personal information including names and Social Security Numbers. The breach affected 6,792 individuals, including 26 Maine residents. The organization provided written notifications to affected parties and offered 24 months of identity theft protection services through Experian IdentityWorks, featuring credit monitoring, identity restoration assistance, and $1 million insurance coverage.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On May 31, 2023, Pear Tree Advisors, Inc., a commercial entity based at 55 Old Bedford Road in Lincoln, Massachusetts, experienced an external system breach resulting from hacking. The breach was discovered on the same day it occurred, indicating rapid detection of unauthorized access. Attackers acquired sensitive personal information, specifically names combined with Social Security Numbers, compromising the data of 6,792 individuals, including 26 Maine residents. The incident did not meet the threshold requiring notification to consumer reporting agencies, as the number of affected Maine residents remained below 1,000. The organization engaged outside counsel Peter Guffin of Pierce Atwood LLP to manage breach disclosures, with formal reporting submitted to Maine’s Office of the Attorney General. No evidence suggested prior breaches within the preceding 12 months, underscoring the novelty of this incident for the financial advisory firm.
Pear Tree Advisors initiated written notifications to all affected individuals on July 7, 2023, approximately five weeks after discovering the breach. The notification included details about the compromised data types and remediation measures, specifically offering 24 months of Experian IdentityWorks protection services at no cost. These services provided daily credit report access, credit monitoring, identity-restoration support, and $1 million identity theft insurance coverage to mitigate potential financial or reputational harm to victims. The company submitted a copy of its Maine-specific consumer notice, titled "EXPERIAN_Job42179d07_PearTreeAdvisors_SAS_2(16203667.1).pdf," as part of regulatory compliance documentation. No additional attacker methodologies, containment procedures, or system vulnerabilities were disclosed in available records. The breach’s operational impacts on Pear Tree Advisors’ infrastructure or client services remained unspecified in official filings.