HackingTechnologyFinancial ServicesInformationStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

GoHenry

bd_2144be1c9575322c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 19, 2022

Filed

May 8, 2023

To disclose

33 weeks

Affected

7state residents only

Linked

5 filings

Confidence

65%

Full breach record for GoHenry →

GoHenry, Ltd notified Montana residents of unauthorized access to customer profiles between September 19 and October 13, 2022. The incident involved the theft of customer credentials, leading to access of personal information including names, addresses, and government IDs. GoHenry conducted an investigation, reissued cards, and enhanced security measures.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 33 weeks / 231 days

Sep 19, 2022

Begins

Sep 19, 2022

Discovered

May 8, 2023

Filed

vs. sector median

+14 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_29dad984702e127a2023-05-08Verified by operator
Massachusetts State AGbd_36d21cc5aef6b8e02023-05-08Verified
New Hampshire State AGbd_c8211f50f181c7cb2023-05-08Verified
Indiana State AGbd_3925cf1eb68aae9f2023-06-08 · +31dVerified

Name: GoHenry
norm: gohenry

Name: GoHenry
norm: gohenry
Industry: TechnologyllmFinancial Servicesllm

Discovered: Sep 19, 2022
Breach occurred: Sep 19, 2022 – Oct 13, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 3, 2023
Affected individuals: 7state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Took steps to confirm that our platform was secure
Conducted a thorough investigation
Completed a comprehensive review of the actions taken by the unauthorized actor
Reissuing your child’s GoHenry card
Changes made: Enhancing existing security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(231 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGMay 8 · first

Massachusetts State AGMay 8 · first

New Hampshire State AGMay 8 · first

Montana State AGMay 8 · first · this page

Indiana State AG+31d

Pattern: first filing May 8 (ME), last Jun 8 (IN) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-268.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 8, 2023
Raw hash: af16db788ef246cb8e20ef43aec7971868d5505304e557ec25b2d6528661ff0b

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityGoHenry

Victim entityGoHenry

Incidentdiscovered Sep 19, 2022

Stated responseTook steps to confirm that our platform was secure

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov