HackingFinancial ServicesFinanceCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountLowContained

Slim CD Inc.

bd_383cec170515bd04 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 15, 2024

Filed

Sep 6, 2024

To disclose

12 weeks

Affected

Not disclosed

Linked

13 filings

Confidence

64%

Full breach record for Slim CD Inc. →

Slim CD, Inc., a payment processing gateway, experienced unauthorized system access between August 17, 2023, and June 15, 2024. The company became aware of suspicious activity on June 15, 2024. The incident potentially exposed names, addresses, credit card numbers, and expiration dates for cardholders who used merchants serviced by Slim CD. The company engaged third-party investigators, notified law enforcement, and is offering credit monitoring and identity theft recovery services to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 15, 2024 → Notified Sep 9, 202486d ✗ CA 60-day late12 weeks discovery → filing

Incident timeline

undetected · 303 days

discovery → filing · 12 weeks / 83 days

Aug 17, 2023

Begins

Jun 15, 2024

Discovered

Sep 6, 2024

Filed

vs. sector median

+3 wks slower

This filing is one of 13 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Delaware State AGbd_4be9c5f703344a922024-09-06Verified
Massachusetts State AGbd_69334fafbaa43b5a2024-09-06Verified
Oregon State AGbd_84b9bc1e6e2c9af32024-09-06Verified
Montana State AGbd_be28cfef1f911eb22024-09-06Verified

Show 6 more filings ↓up to 40d gap

Washington State AGbd_d9f7b4dd7243de402024-09-06Verified
Indiana State AGbd_da3c5ebbf226f9af2024-09-06Verified
New Hampshire State AGbd_1e7bc1d2603ff8562024-09-09 · +3dVerified
South Carolina State AGbd_a3f5ecb5444cd34e2024-09-09 · +3dVerified
Maine State AGbd_ae0631450fc6c78c2024-10-09 · +33dCandidate
Maine State AGbd_a3b48ff3d240e2172024-10-16 · +40dCandidate

Showing first 10 of 12 linked disclosures.

Name: Slim CD Inc.
norm: slim cd
Domain: slimcd.com

Name: Slim CD Inc.
norm: slim cd
Domain: slimcd.com
Industry: Financial Servicesllm

Discovered: Jun 15, 2024
Breach occurred: Aug 17, 2023 – Jun 15, 2024
Undetected for: 303 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 9, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported this incident to federal law enforcement, and regulatory authorities, as required by law

During the incident: Engaged, through counsel, a third-party specialist to investigate the incident
Reported this incident to federal law enforcement, and regulatory authorities, as required by law
Providing you with months of complimentary access to credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed id theft recovery services through IDX, A ZeroFox Company
Changes made: Implemented additional safeguards
Reviewed policies and procedures relating to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(83 days from discovery to filing)
Compliance flags: CA 60-day late · 86d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 15, 2024
→ Notified: Sep 9, 2024
86d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 15, 2024 → Notified: Sep 9, 2024	86d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

Delaware State AGSep 6 · first

Massachusetts State AGSep 6 · first

Oregon State AGSep 6 · first

Montana State AGSep 6 · first

Washington State AGSep 6 · first

Indiana State AGSep 6 · first

California State AGSep 6 · first · this page

New Hampshire State AG+3d

South Carolina State AG+3d

Maine State AG+33d

Maine State AG+40d

Pattern: first filing Sep 6 (DE), last Oct 16 (ME) — a 40-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 12 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-591349
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 6, 2024
Raw hash: 54b2696453f6e4ce29aef3f9e10a6074eefc875fcc3bb89704a4bb4afa13763c

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entitySlim CD Inc.

Victim entitySlim CD Inc.

Incidentdiscovered Jun 15, 2024

Stated responseEngaged, through counsel, a third-party specialist to investigate the incident

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov