HackingFinancial ServicesTechnologyFinanceStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)Financial accountCredentialsLowContained

Tally Technologies, Inc.

bd_0d4cbad57d3ce5fa · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 5, 2022

Filed

Aug 4, 2022

To disclose

4 weeks

Affected

46state residents only

Confidence

66%

Full breach record for Tally Technologies, Inc. →

Tally Technologies, Inc. notified Washington AG of a July 5, 2022 incident where unauthorized parties used stolen customer credentials (usernames/passwords) from a third-party source to attempt access to Tally accounts. Compromised data included names, contact info, financial account details, and credit card info. Customers were required to reset passwords and offered identity protection services.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d4 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 4 weeks / 30 days

Jul 5, 2022

Discovered

Aug 4, 2022

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed46 affectedView incident

Name: Tally Technologies, Inc.
norm: tally technologies

Name: Tally Technologies, Inc.
norm: tally technologies
Industry: Financial ServicesllmTechnologyllm

Discovered: Jul 5, 2022
Materiality determined: —
Notification sent: Aug 4, 2022
Affected individuals: 46state-resident count only
Data types: PIIIdentity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Required any potentially affected customers to reset their Tally passwords
Implementing additional technical security measures to prevent future incidents
Offering complimentary identity protection services
Changes made: Implementing additional technical security measures to prevent future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA13255.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 4, 2022
Raw hash: 8e49074ed8507ce6bdc3c2250ef8bf34520fb93a50afcc65e163d082e7eb4c20

Reporting entityTally Technologies, Inc.

Victim entityTally Technologies, Inc.

Incidentdiscovered Jul 5, 2022

Stated responseRequired any potentially affected customers to reset their Tally passwords

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com