AccidentalFinancial ServicesFinanceMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumActive

Auto Approve, LLC

bd_44b17dea724fc913 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 15, 2019

Filed

Oct 28, 2019

To disclose

6 weeks

Affected

433state residents only

Linked

6 filings

Confidence

66%

Full breach record for Auto Approve, LLC →

Auto Approve, LLC notified the NH Attorney General of a data event affecting 433 New Hampshire residents. On September 15, 2019, a security researcher alerted the company to a system vulnerability exposed after a maintenance release, which left personal information (including SSNs, names, addresses, and loan details) accessible to external parties for approximately three weeks. No evidence of unauthorized access beyond the researcher was found. The company remediated the vulnerability, secured the data, and offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 43 days

Sep 15, 2019

Begins

Sep 15, 2019

Discovered

Oct 28, 2019

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_51b08a2737b12a6a2019-10-28Candidate
California State AGbd_5e4925cd13b6b0e02019-10-28Verified
Oregon State AGbd_63828ec7be9499772019-10-28Verified
Massachusetts State AGbd_6ebe7445d6cbea3e2019-10-28Verified

Show 1 more filing ↓up to 4d gap

South Carolina State AGbd_c92718bd858fb8c32019-11-01 · +4dVerified

Name: Auto Approve, LLC
norm: auto approve

Name: Auto Approve, LLC
norm: auto approve
Industry: Financial Servicesllm

Discovered: Sep 15, 2019
Breach occurred: Sep 15, 2019
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 28, 2019
Affected individuals: 433state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Misconfiguration
Regulator citations: Notified New Hampshire Attorney GeneralNotifying other regulators as required

During the incident: Secured the involved information
Investigated the full scope of the incident
Notified potentially affected individuals
Providing individuals with access to two (2) years of credit monitoring and identity protection services through Trans Union, at no cost to the individuals
Providing potentially impacted individuals with guidance on how to better protect against identity theft and fraud
Notifying other regulators as required
Changes made: Remediated the system vulnerability
Re-secured the information
Taking additional actions to maximize the security of data in its possession
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGOct 28 · first

California State AGOct 28 · first

Oregon State AGOct 28 · first

Massachusetts State AGOct 28 · first

New Hampshire State AGOct 28 · first · this page

South Carolina State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/auto-approve-20191028.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 28, 2019
Raw hash: baa020c14b6439e9f710ed216109b9e3403202e19fb197bf5add63e00e39fd76

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAuto Approve, LLC

Victim entityAuto Approve, LLC

Incidentdiscovered Sep 15, 2019

Stated responseSecured the involved information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov