HackingTechnologyFinancial ServicesInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

LightYear Dealer Technologies, LLC d/b/a DealerBuilt

bd_0f3ecc978f9799a4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 7, 2016

Filed

Jan 9, 2017

To disclose

9 weeks

Affected

26state residents only

Linked

2 filings

Confidence

65%

LightYear Dealer Technologies (dba DealerBuilt) notified the NH AG of a data security event where backup data for car dealerships was accessible via the internet. Unauthorized access occurred between Oct 29 and Nov 7, 2016. Data exposed included names, DOB, SSN, driver's license, and credit card numbers. 26 NH residents affected. Notifications sent Jan 9, 2017.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 9 days

discovery → filing · 9 weeks / 63 days

Oct 29, 2016

Begins

Nov 7, 2016

Discovered

Jan 9, 2017

Filed

vs. sector median

10 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_99e4874224de633e2017-01-09Verified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: LightYear Dealer Technologies, LLC d/b/a DealerBuilt
norm: lightyear dealer technologies dealerbuilt
Also named: LightYear Dealer Technologies, LLCdba oflegal entity
DealerBuiltdba oftrade name
Industry: TechnologyllmFinancial Servicesllm

Discovered: Nov 7, 2016
Breach occurred: Oct 29, 2016 – Nov 7, 2016
Undetected for: 9 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 9, 2017
Affected individuals: 26state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified New Hampshire Attorney GeneralProvided written notice to other state regulators and consumer reporting agencies where required
Initial access: exploit_public_facing

During the incident: Changed the backup process to prevent unsecured access from the internet
Shut off the affected server
Retained third party computer forensic investigators
Began mailing notice letters to potentially affected individuals
Offered one year of credit monitoring and identity restoration services with Experian ProtectMyID
Changes made: Retained a separate IT firm to assist with a security audit of its systems
Implemented additional measures to further protect its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJan 9 · first

New Hampshire State AGJan 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/dealerbuilt-20170109.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 9, 2017
Raw hash: e25922ed839c9919fb52a4a4e57f9159afa0ab89a596908436e10079c85187ba

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityLightYear Dealer Technologies, LLC d/b/a DealerBuilt

Incidentdiscovered Nov 7, 2016

Stated responseChanged the backup process to prevent unsecured access from the internet

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov