Social EngineeringTechnologyInformationPhishingTargetedIdentity (basic)PIILowContained

HopSkipDrive

bd_0effe01819aaca82 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 25, 2023

Filed

Feb 2, 2024

To disclose

27 weeks

Affected

34state residents only

Linked

6 filings

Confidence

65%

Full breach record for HopSkipDrive →2 incidents on file

HopSkipDrive, Inc. notified Montana residents of a data incident where an unknown threat actor accessed third-party applications via phishing. The incident occurred May 31–June 10, 2023. Personal information including names, addresses, and emails may have been impacted. HopSkipDrive engaged forensic experts and offered complimentary TransUnion credit monitoring and fraud assistance.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 55 days

discovery → filing · 27 weeks / 192 days

May 31, 2023

Begins

Jul 25, 2023

Discovered

Feb 2, 2024

Filed

vs. sector median

+9 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_4d28f1139039e4522024-02-02Verified
Maine State AGbd_d815966810d8f7532024-02-02Verified
Massachusetts State AGbd_2c4bfd8dbf0df0832024-02-03 · +1dVerified
Vermont State AGbd_5b9dbc45bc576fc82024-02-03 · +1dVerified

Show 1 more filing ↓up to 1d gap

Illinois State AGbd_b11da8949437e91e2024-02-01 · +1dVerified

Name: HopSkipDrive
norm: hopskipdrive
Domain: admin.hopskipqa.com

Name: HopSkipDrive
norm: hopskipdrive
Domain: admin.hopskipqa.com
Industry: Technologyllm

Discovered: Jul 25, 2023
Breach occurred: May 31, 2023 – Jun 10, 2023
Undetected for: 55 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 34state-resident count only
Data types: Identity (basic)PII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Initial access: phishing_link

During the incident: Launched an investigation
Engaged experts to assist in assessing the scope of the incident
Took steps to mitigate the potential impact
Arranged for you to activate, at no cost to you, TransUnion credit monitoring
Providing you with proactive fraud assistance
Changes made: Strengthening our systems’ security to prevent a similar event from occurring again in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(192 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGFeb 1 · first

California State AG+1d

Maine State AG+1d

Montana State AG+1d · this page

Massachusetts State AG+2d

Vermont State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1074.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 2, 2024
Raw hash: 8be8ba5066cae4122f9a61053b539455386816ee5d822d1ef408d39216cba5ce

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityHopSkipDrive

Victim entityHopSkipDrive

Incidentdiscovered Jul 25, 2023

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov