HackingRetail & ConsumerRetailDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

LANE AUTOMOTIVE, INC.

bd_1eee39d319c1079d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 14, 2025

Filed

Mar 12, 2025

To disclose

26 days

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for LANE AUTOMOTIVE, INC. →

Lane Automotive, Inc. notified the Maryland Attorney General of a cybersecurity incident affecting approximately 2 Maryland residents. Unauthorized access to files containing names, SSNs, bank account/routing numbers, and passport numbers occurred around March 23, 2023, and was discovered via forensic review on February 14, 2025. The company offered one year of credit monitoring and provided identity theft prevention resources.

J jump to incidentP pin to compareR raw source

Maryland clock✓ MD AG ≤30d26 days discovery → filing

Incident timeline

undetected · 694 days

discovery → filing · 26 days

Mar 23, 2023

Begins

Feb 14, 2025

Discovered

Mar 12, 2025

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_47148909cc6c1a942025-03-12Verified
Maine State AGbd_6932e155e9162e772025-03-12Candidate
Nebraska State AGbd_0537a561a9f22ed42025-03-25 · +13dVerified

Name: LANE AUTOMOTIVE, INC.
norm: lane automotive

Name: LANE AUTOMOTIVE, INC.
norm: lane automotive
Industry: Retail & Consumerllm

Discovered: Feb 14, 2025
Breach occurred: Mar 23, 2023
Undetected for: 694 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 12, 2025
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Maryland Office of the Attorney General

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Conducted extensive forensic investigation and manual document review
Providing affected residents with written notification
Offering complimentary one-year membership with a credit monitoring service
Advised affected residents to remain vigilant in reviewing financial account statements
Provided best practices to protect personal information, such as placing a fraud alert and/or security freeze on their credit files
Provided contact information for consumer reporting agencies and the Federal Trade Commission and the Maryland Attorney General
Changes made: Continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 days(26 days from discovery to filing)
Compliance flags: MD AG ≤30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGMar 12 · first

Maine State AGMar 12 · first

Maryland State AGMar 12 · first · this page

Nebraska State AG+13d

Pattern: first filing Mar 12 (IN), last Mar 25 (NE) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376542.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 12, 2025
Raw hash: 3f193a158d4bb0d015be325e0c50eed552abfc1973568abd0adb9d197c9d60c0

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityLANE AUTOMOTIVE, INC.

Victim entityLANE AUTOMOTIVE, INC.

Incidentdiscovered Feb 14, 2025

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

ComplianceMD AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov