HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumActive

Progressive Leasing

bd_1d1b9dd739810e98 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 11, 2023

Filed

Oct 23, 2023

To disclose

6 weeks

Affected

40state residents only

Linked

10 filings

Confidence

66%

Full breach record for Progressive Leasing →2 incidents on file

Progressive Leasing notified Montana residents of a data breach where an unauthorized third party accessed the network between September 9-11, 2023. Personal information including names, SSNs, DOBs, and addresses of customers and employees was compromised. The company engaged cybersecurity experts, notified law enforcement, and offered 12 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 6 weeks / 42 days

Sep 9, 2023

Begins

Sep 11, 2023

Discovered

Oct 23, 2023

Filed

vs. sector median

2 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Oregon State AGbd_2343ba4ecbd94ae82023-10-23Verified
Maine State AGbd_31d8aa8dacf4c1cb2023-10-23Verified
Delaware State AGbd_acf2552b7336114e2023-10-23Verified
Massachusetts State AGbd_bef96dbb3ba948a42023-10-23Verified

Show 5 more filings ↓up to 32d gap

Washington State AGbd_2047ab3d4f323b6c2023-10-24 · +1dVerified
South Carolina State AGbd_6e9645f368f8433a2023-10-24 · +1dVerified
California State AGbd_9c14cbb322c102712023-10-22 · +1dVerified
New Hampshire State AGbd_707166e8373b559a2023-10-30 · +7dVerified
SEC 8-Kbd_981201c9f13646f02023-09-21 · +32dCandidate

Name: Progressive Leasing
norm: progressive leasing
Domain: progleasing.com

Name: Progressive Leasing
norm: progressive leasing
Domain: progleasing.com
Industry: Financial Servicesllm

Discovered: Sep 11, 2023
Breach occurred: Sep 9, 2023
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 23, 2023
Affected individuals: 40state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified law enforcement
Initial access: valid_credentials

During the incident: Engaged leading cybersecurity experts and launched an investigation
Notified law enforcement
Took immediate steps to secure our network environment
Hired cybersecurity experts to assist us in our investigation and containment
Secured the services of Experian to provide credit monitoring, identity restoration, and identity theft protection
Changes made: Working with cybersecurity experts to continue to strengthen our security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

SEC 8-KSep 21 · first

California State AG+31d

Oregon State AG+32d

Maine State AG+32d

Delaware State AG+32d

Massachusetts State AG+32d

Montana State AG+32d · this page

Washington State AG+33d

South Carolina State AG+33d

New Hampshire State AG+39d

Pattern: first filing Sep 21, last Oct 30 (NH) — a 39-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-789.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 23, 2023
Raw hash: 77214feae4938981f86de719d7c24fcff1dec645b20aeb01babfcf90444865db

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityProgressive Leasing

Victim entityProgressive Leasing

Incidentdiscovered Sep 11, 2023

Stated responseEngaged leading cybersecurity experts and launched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov