Challenge Financial Services, Inc.

An unauthorized party sat inside Challenge Financial Services' environment for two days in August 2026 before anyone noticed; the filing never says how they got in. Thirteen days passed between that access and discovery, and in that space is where names, Social Security numbers, addresses, and birth dates left the building. Settra, the ransomware group claiming the haul, is also the only source describing what was taken. A breach notice that leans on the extortionist's own numbers isn't disclosure, it's a company reading its intruder's ransom payment timing demand back to its customers.