HackingFinancial ServicesFinanceStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

GardaWorld Cash U.S.

bd_06b9dd1f68d17bae · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 16, 2023

Filed

Mar 28, 2024

To disclose

19 weeks

Affected

189state residents only

Linked

11 filings

Confidence

66%

Full breach record for GardaWorld Cash U.S. →

GardaWorld Cash U.S. notified the NH AG of a breach affecting 189 NH residents. Unauthorized access occurred Oct 30-Nov 16, 2023, discovered Nov 16, 2023. Administrative files copied. Data likely included PII/SSN. Notifications mailed March 22, 2024, with 24 months credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 17 days

discovery → filing · 19 weeks / 133 days

Oct 30, 2023

Begins

Nov 16, 2023

Discovered

Mar 28, 2024

Filed

vs. sector median

+11 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Massachusetts State AGbd_0da324327d3945642024-03-22 · +6dVerified
Maine State AGbd_0e1b21509eb07ef52024-03-22 · +6dCandidate
California State AGbd_2688209c79606e8b2024-03-22 · +6dVerified
Vermont State AGbd_740aa781d9cce1fd2024-03-22 · +6dVerified

Show 6 more filings ↓up to 27d gap

Oregon State AGbd_7416629fa1a9ccca2024-03-22 · +6dVerified
Washington State AGbd_ad65ae76f4ee4ad32024-03-22 · +6dVerified
Delaware State AGbd_b0ebb9df09562ad92024-03-22 · +6dVerified
Indiana State AGbd_bb072a3fa48d35232024-03-22 · +6dVerified
Montana State AGbd_fe76d026e22de9832024-03-22 · +6dVerified
Illinois State AGbd_8153c2e5e7269df12024-03-01 · +27dVerified

Name: GardaWorld Cash U.S.
norm: gardaworld cash us

Name: GardaWorld Cash U.S.
norm: gardaworld cash us
Industry: Financial Servicesllm

Discovered: Nov 16, 2023
Breach occurred: Oct 30, 2023 – Nov 16, 2023
Undetected for: 17 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 22, 2024
Affected individuals: 189state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Filed Legal Notice of Data Security Incident with New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Promptly took steps to secure its systems
Launched an investigation
Engaged external cybersecurity experts to assist
Conducted a robust review of the data
Began mailing notification letters to individuals
Offering the New Hampshire residents twenty-four months of complimentary three-bureau credit monitoring and fraud protection services
Changes made: Took additional steps to secure its systems
Continues to evaluate technical and organizational measures to avoid the reoccurrence of a similar incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(133 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Illinois State AGMar 1 · first

Massachusetts State AG+21d

Maine State AG+21d

California State AG+21d

Vermont State AG+21d

Oregon State AG+21d

Washington State AG+21d

Delaware State AG+21d

Indiana State AG+21d

Montana State AG+21d

New Hampshire State AG+27d · this page

Pattern: first filing Mar 1 (IL), last Mar 28 (NH) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/gardaworld-cash-us-20240328.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 28, 2024
Raw hash: ec46a24a5ee716cb114f1eb2e1acf8f302ac8ffe75b086c0c59a0c04f3bbbf3c

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityGardaWorld Cash U.S.

Victim entityGardaWorld Cash U.S.

Incidentdiscovered Nov 16, 2023

Stated responsePromptly took steps to secure its systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov