HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)MediumContained

GardaWorld Cash U.S.

bd_2688209c79606e8b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 16, 2023

Filed

Mar 22, 2024

To disclose

18 weeks

Affected

Not disclosed

Linked

11 filings

Confidence

65%

Full breach record for GardaWorld Cash U.S. →

GardaWorld Cash U.S. disclosed a cybersecurity incident where an unauthorized actor accessed administrative files on facility systems in Florida between October 30 and November 16, 2023. The actor copied some files on November 16, 2023. Affected data may include names, Social Security numbers, Driver’s License numbers, dates of birth, and health-related information. The company engaged external cybersecurity experts, secured systems, and offered two years of identity monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 16, 2023 → Notified Mar 15, 2024120d ✗ CA 60-day late18 weeks discovery → filing

Incident timeline

undetected · 17 days

discovery → filing · 18 weeks / 127 days

Oct 30, 2023

Begins

Nov 16, 2023

Discovered

Mar 22, 2024

Filed

vs. sector median

1 wks faster

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Massachusetts State AGbd_0da324327d3945642024-03-22Verified
Maine State AGbd_0e1b21509eb07ef52024-03-22Candidate
Vermont State AGbd_740aa781d9cce1fd2024-03-22Verified
Oregon State AGbd_7416629fa1a9ccca2024-03-22Verified

Show 6 more filings ↓up to 21d gap

Washington State AGbd_ad65ae76f4ee4ad32024-03-22Verified
Delaware State AGbd_b0ebb9df09562ad92024-03-22Verified
Indiana State AGbd_bb072a3fa48d35232024-03-22Verified
Montana State AGbd_fe76d026e22de9832024-03-22Verified
New Hampshire State AGbd_06b9dd1f68d17bae2024-03-28 · +6dVerified
Illinois State AGbd_8153c2e5e7269df12024-03-01 · +21dVerified

Name: GardaWorld Cash U.S.
norm: gardaworld cash us

Name: GardaWorld Cash U.S.
norm: gardaworld cash us
Industry: Professional Servicesllm

Discovered: Nov 16, 2023
Breach occurred: Oct 30, 2023 – Nov 16, 2023
Undetected for: 17 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 15, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Took steps to secure our systems
Launched an investigation
Engaged external cybersecurity experts to assist
Conducted a robust review of the data to identify individuals whose information may have been impacted
Arranged for a complimentary 2-year subscription to CyEx Identity Defense Total
Changes made: Took additional steps to secure our systems
Continue to evaluate technical and organizational measures to avoid the recurrence of a similar incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(127 days from discovery to filing)
Compliance flags: CA 60-day late · 120d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 16, 2023
→ Notified: Mar 15, 2024
120d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 16, 2023 → Notified: Mar 15, 2024	120d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Illinois State AGMar 1 · first

Massachusetts State AG+21d

Maine State AG+21d

Vermont State AG+21d

Oregon State AG+21d

Washington State AG+21d

Delaware State AG+21d

Indiana State AG+21d

Montana State AG+21d

California State AG+21d · this page

New Hampshire State AG+27d

Pattern: first filing Mar 1 (IL), last Mar 28 (NH) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-582908
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 22, 2024
Raw hash: 41af05e1ccd4f848f2ce289a410588003a9fa3d6a6f2b43d193770b48944d3c1

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityGardaWorld Cash U.S.

Victim entityGardaWorld Cash U.S.

Incidentdiscovered Nov 16, 2023

Stated responseTook steps to secure our systems

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov