HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDPIIMediumContained

Automotive Recovery Services. Inc.

bd_1d18cd4f39ef1183 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jul 6, 2015

To disclose

—

Affected

Not disclosed

Linked

5 filings

Confidence

64%

Full breach record for Automotive Recovery Services. Inc. →

Automotive Recovery Services, Inc. disclosed a breach of legacy systems affecting vehicle donation processing data. Unauthorized access occurred between July 2012 and May 2015, exposing names, SSNs, driver's license numbers, and contact information of individuals who donated vehicles to charities. No evidence of misuse was found. The company provided 12 months of identity protection services via AllClear ID and implemented additional security layers.

J jump to incidentP pin to compareR raw source

Incident timeline

Jul 1, 2012

Begins

Jul 6, 2015

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_7c428f9b588f35fe2015-07-06Verified
South Carolina State AGbd_bbaea8979431c03a2015-07-07 · +1dCandidate
Hawaii State AGbd_867d23aad23b34f52015-07-09 · +3dVerified
Massachusetts State AGbd_f0b056337d7829232015-07-10 · +4dVerified

Name: Automotive Recovery Services. Inc.
norm: automotive recovery

Name: Automotive Recovery Services. Inc.
norm: automotive recovery
Industry: Professional Servicesllm

Discovered: —
Breach occurred: Jul 1, 2012 – May 31, 2015
Materiality determined: —
Notification sent: Jul 1, 2015
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDPII
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Arranged to have AllClear ID protect your identity for 12 months at no cost to you
Refining security programs and implementing additional security layers
Changes made: Refining security programs and implementing additional security layers
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

New Hampshire State AGJul 6 · first

California State AGJul 6 · first · this page

South Carolina State AG+1d

Hawaii State AG+3d

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-56920
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 6, 2015
Raw hash: 5856982e42f38042cd88dfbdb627ebcb412d24985f9ebea9712c77ce5088727d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAutomotive Recovery Services. Inc.

Victim entityAutomotive Recovery Services. Inc.

IncidentUnauthorized Access

Stated responseArranged to have AllClear ID protect your identity for 12 months at no cost to you

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov