HackingTechnologyInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHighContained

SafetyFirst

bd_040d0e18b0e6fc0b · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 19, 2026

Filed

Jul 23, 2026

To disclose

26 weeks

Affected

1,235state residents only

Linked

9 filings

Confidence

64%

Full breach record for SafetyFirst →2 incidents on file

Safetyfirst Systems, LLC, a provider of driver/employee compliance and Motor Vehicle Records services, disclosed a data security incident affecting South Carolina residents. Unauthorized access occurred between January 16 and January 19, 2026, potentially exposing names and Social Security numbers. The company engaged third-party experts, notified law enforcement, and provided complimentary credit monitoring. Full containment was documented by July 23, 2026.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due26 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 3 days

discovery → filing · 26 weeks / 185 days

Jan 16, 2026

Begins

Jan 19, 2026

Discovered

Jul 23, 2026

Filed

vs. sector median

+8 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

New Hampshire State AGbd_440e40e75b8e3bab2026-07-23Verified
Nebraska State AGbd_50b680190ffb752e2026-07-23Verified
Oregon State AGbd_52833391eb61f3fd2026-07-23Verified
Massachusetts State AGbd_60c66a4e1edccb922026-07-23Candidate

Show 4 more filings ↓up to 22d gap

Washington State AGbd_bc745a0679daa31f2026-07-23Verified
California State AGbd_d59ad81fdec3e96e2026-07-23Candidate
Texas State AGbd_dff0e099643dee8d2026-07-23Verified
Illinois State AGbd_03fb70879d50edd32026-07-01 · +22dVerified

Name: SafetyFirst
norm: safetyfirst
Domain: safetyfirst.com

Name: SafetyFirst
norm: safetyfirst
Domain: safetyfirst.com
Industry: Technologyllm

Discovered: Jan 19, 2026
Breach occurred: Jan 16, 2026 – Jan 19, 2026
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 23, 2026
Affected individuals: 1,235state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified law enforcement
Initial access: valid_credentials

During the incident: Secured and remediated the compromise
Engaged additional third-party experts
Hardened and enhanced our data security
Commenced an investigation
Engaged a national cybersecurity firm to assist in assessing the scope of the incident
Notified law enforcement
Changes made: Evaluating opportunities to further secure our systems to prevent a similar event from occurring again in the future
Arranged for complimentary TransUnion Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services
Providing proactive fraud assistance through Cyberscout
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(185 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGJul 1 · first

New Hampshire State AG+22d

Nebraska State AG+22d

Oregon State AG+22d

Massachusetts State AG+22d

Washington State AG+22d

California State AG+22d

Texas State AG+22d

South Carolina State AG+22d · this page

Pattern: first filing Jul 1 (IL), last Jul 23 (SC) — a 22-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter-%20SafetyFirst%20Systems%2C%20LLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 23, 2026
Raw hash: 804ff8d5ae2f2a5ef55b4d640776f66895bdbbfe778df41db1a97a48273e00fb

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entitySafetyFirst

Victim entitySafetyFirst

Incidentdiscovered Jan 19, 2026

Stated responseSecured and remediated the compromise

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov