MisuseFinancial ServicesFinancePrivilege AbuseEmployee Data InvolvedIdentity (basic)Government IDFinancial accountPIIMediumContained

ALLY

bd_0280381432a6312d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 22, 2021

Filed

Jan 27, 2022

To disclose

5 weeks

Affected

2state residents only

Confidence

66%

Full breach record for ALLY →4 incidents on file

Ally notified Montana residents that a former employee accessed consumer deposit account information outside their job scope on December 22, 2021. No unauthorized transactions were identified. Affected data included names, addresses, DOB, partial SSNs, and account details. Ally provided 24 months of Equifax credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 36 days

Dec 22, 2021

Discovered

Jan 27, 2022

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: ALLY
norm: ally
Domain: ally.com

Name: ALLY
norm: ally
Domain: ally.com
Industry: Financial Servicesllm

Discovered: Dec 22, 2021
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial accountPII
Data elements: Social Security numberDate of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Initial access: insider_action

During the incident: Implemented supplemental fraud monitoring and controls
Engaged Equifax to provide Equifax Complete Premier product for 24 months
Changes made: Implemented supplemental fraud monitoring and controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Ally-Consumer-Notification-Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 27, 2022
Raw hash: c05f7ae0d5e821413ab5a93c4bf5f33c5214bccbc7b306df3554f02ff1f250da

Reporting entityALLY

Victim entityALLY

Incidentdiscovered Dec 22, 2021

Stated responseImplemented supplemental fraud monitoring and controls

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov