HackingTechnologyInformationStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

INTUIT INC.

bd_06a43f09381f2b26 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 21, 2024

Filed

Dec 20, 2024

To disclose

29 days

Affected

1state residents only

Linked

4 filings

Confidence

66%

All records for INTUIT INC. →75 incidents on file

Account takeover notice

INTUIT INC. notified customers of unauthorized access to their accounts. The filing says: “This is not a notice of any kind of systemic data breach of Intuit Inc. ("Intuit").”

Intuit Inc. reported a cybersecurity incident affecting 1 Maine resident. Unauthorized access occurred between March 5 and March 18, 2024, discovered on November 21, 2024. The attacker used stolen credentials to access a TurboTax account, exposing PII including SSN, DOB, and financial data. Intuit secured the account and offered 12 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 21, 2024 → Filed with AG Dec 20, 202429d ✓ ME AG ≤30d29 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 261 days

discovery → filing · 29 days

Mar 5, 2024

Begins

Nov 21, 2024

Discovered

Dec 20, 2024

Filed

vs. sector median

7 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_b52790982318322b2024-12-20Verified
Massachusetts State AGbd_bdf31823fc0bb31e2024-12-20Verified by operator
Indiana State AGbd_80bdcf2c482de2932025-02-12 · +54dVerified

Name: INTUIT INC.
norm: intuit
Domain: intuit.com

Name: INTUIT INC.
norm: intuit
Domain: intuit.com
Industry: Technologyllm

Discovered: Nov 21, 2024
Account access: Mar 5, 2024 – Mar 18, 2024
Undetected for: 261 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 20, 2024
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Made your TurboTax account temporarily unavailable to protect your information from any further unauthorized access
Offering you one year of free identity protection, credit monitoring and identity restoration services through Experian IdentityWorks
Conducted an investigation and took steps to secure your account
Changes made: Recommended that you immediately change your passwords for those accounts, particularly if you use the same username and password as the one used for your Intuit online account
Recommended using the Google Authenticator app for verification upon every login
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: ME AG ≤30d · 29d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 21, 2024
→ Filed with AG: Dec 20, 2024
29d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 21, 2024 → Filed with AG: Dec 20, 2024	29d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Indiana State AGDec 20 · first

Massachusetts State AGDec 20 · first

Maine State AGDec 20 · first · this page

Indiana State AG+54d

Pattern: first filing Dec 20 (IN), last Feb 12 (IN) — a 54-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/ca322ddd-7d8d-46bc-aa65-d09c30220c16.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 20, 2024
Raw hash: cebb4d39f8755164b5020c6e662d7bfa8a94c1d5e7c522ad489622f1b9c42b0e

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityINTUIT INC.

Victim entityINTUIT INC.

Incidentdiscovered Nov 21, 2024

Stated responseMade your TurboTax account temporarily unavailable to protect your information from any further unauthorized access

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov