AccidentalFinancial ServicesFinanceMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHighContained

Auto Approve, LLC

bd_5e4925cd13b6b0e0 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 15, 2019

Filed

Oct 28, 2019

To disclose

6 weeks

Affected

9,549state residents only

Linked

6 filings

Confidence

66%

Full breach record for Auto Approve, LLC →

Auto Approve, LLC disclosed a data event where a system vulnerability exposed personal information of auto loan customers for approximately three weeks. The vulnerability was discovered on September 15, 2019, after a security researcher alerted the company. The exposed data included names, addresses, Social Security numbers, dates of birth, loan information, and vehicle details. Approximately 9,549 California residents were affected. Auto Approve remediated the issue, notified affected individuals, and offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 15, 2019 → Notified Oct 28, 201943d ✓ CA 60-day OK6 weeks discovery → filing

Incident timeline

undetected · 18 days

discovery → filing · 6 weeks / 43 days

Aug 28, 2019

Begins

Sep 15, 2019

Discovered

Oct 28, 2019

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_44b17dea724fc9132019-10-28Verified
Montana State AGbd_51b08a2737b12a6a2019-10-28Candidate
Oregon State AGbd_63828ec7be9499772019-10-28Verified
Massachusetts State AGbd_6ebe7445d6cbea3e2019-10-28Verified

Show 1 more filing ↓up to 4d gap

South Carolina State AGbd_c92718bd858fb8c32019-11-01 · +4dVerified

Name: Auto Approve, LLC
norm: auto approve

Name: Auto Approve, LLC
norm: auto approve
Industry: Financial Servicesllm

Discovered: Sep 15, 2019
Breach occurred: Aug 28, 2019 – Sep 19, 2019
Undetected for: 18 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 28, 2019
Affected individuals: 9,549state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Misconfiguration
Regulator citations: Notified California Attorney GeneralNotifying other regulators as required
Initial access: exploit_public_facing

During the incident: Immediately remediated the vulnerability and re-secured the information
Provided written notice to all affected individuals
Offered 24 months of complimentary credit monitoring and identity protection services through TransUnion
Provided guidance on how to better protect against identity theft and fraud
Notifying other regulators as required
Changes made: Remediated the system vulnerability
Re-secured the information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: CA 60-day OK · 43d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 15, 2019
→ Notified: Oct 28, 2019
43d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 15, 2019 → Notified: Oct 28, 2019	43d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGOct 28 · first

Montana State AGOct 28 · first

Oregon State AGOct 28 · first

Massachusetts State AGOct 28 · first

California State AGOct 28 · first · this page

South Carolina State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-183864
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 28, 2019
Raw hash: 2a2657a7d9398217cd7264cff27fc3177082d5e0794bf32e34ca9b4d22c9e99c

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAuto Approve, LLC

Victim entityAuto Approve, LLC

Incidentdiscovered Sep 15, 2019

Stated responseImmediately remediated the vulnerability and re-secured the information

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov