MalwareFinancial ServicesFinanceRansomwareRansom DemandedData ExfiltratedTargetedIdentity (basic)Government IDHighContained

AUTOPAY Direct, Inc.

bd_2c0e299e2e7ca1b0 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 5, 2022

Filed

Apr 14, 2022

To disclose

10 weeks

Affected

2,636state residents only

Linked

8 filings

Confidence

64%

Full breach record for AUTOPAY Direct, Inc. →2 incidents on file

AUTOPAY Direct, Inc. notified customers of a data breach where a threat actor infiltrated its network, exfiltrated PII (names, SSNs, driver's licenses, DOBs), and demanded ransom. The company did not pay, engaged forensic investigators, terminated access, and implemented MFA and enhanced security controls. Incident occurred Feb 2-3, 2022; notification sent Feb 5, 2022.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due10 weeks discovery → filing

⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Incident timeline

undetected · 3 days

discovery → filing · 10 weeks / 68 days

Feb 2, 2022

Begins

Feb 5, 2022

Discovered

Apr 14, 2022

Filed

vs. sector median

on median

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Washington State AGbd_27c3947e62aa6b162022-04-14Verified
Maine State AGbd_702f47d2350c448f2022-04-14Verified
Indiana State AGbd_e1528908ef61677d2022-04-11 · +3dVerified
New Hampshire State AGbd_07d252a1f53fa0562022-04-18 · +4dVerified

Show 3 more filings ↓up to 103d gap

California State AGbd_29d55959bdbcd9252022-04-26 · +12dVerified
Montana State AGbd_d2c472e50e8656412022-03-31 · +14dVerified
Illinois State AGbd_2e2021ad759667742022-01-01 · +103dCandidate

Name: AUTOPAY Direct, Inc.
norm: autopay direct

Name: AUTOPAY Direct, Inc.
norm: autopay direct
Industry: Financial Servicesllm

Discovered: Feb 5, 2022
Breach occurred: Feb 2, 2022 – Feb 3, 2022
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 5, 2022
Affected individuals: 2,636state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement (FBI/financial regulators recommended against ransom payment)
Initial access: exploit_public_facing

During the incident: Notifying law enforcement
Successfully terminating all unauthorized access
Undertaking a full forensic investigation of the incident
Changes made: Implementing multifactor authentication for all users across the organization
Configuring additional security measures on our information technology platforms (including enhanced password management, access control restrictions and updated logging capabilities)
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(68 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+89d

Indiana State AG+100d

Washington State AG+103d

Maine State AG+103d

South Carolina State AG+103d · this page

New Hampshire State AG+107d

California State AG+115d

Pattern: first filing Jan 1 (IL), last Apr 26 (CA) — a 115-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/AUTOPAYDirectInc..pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 14, 2022
Raw hash: 7da4e70005b251e5c594e8eb0a7f180c3f9e59b3b78e7905174430cc129add95

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityAUTOPAY Direct, Inc.

Victim entityAUTOPAY Direct, Inc.

Incidentdiscovered Feb 5, 2022

Stated responseNotifying law enforcement

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov