AccidentalTechnologyInformationMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDMediumContained

HelloTech

bd_65610fc111001e7a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 15, 2019

Filed

Dec 13, 2019

To disclose

28 days

Affected

6state residents only

Linked

2 filings

Confidence

66%

Full breach record for HelloTech →2 incidents on file

HelloTech, Inc. notified Montana and other states of a data breach on November 15, 2019, where independent contractor data was publicly accessible due to misconfiguration. Data included names, addresses, and driver license info. No SSN or financial data involved. HelloTech secured the data, investigated, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 28 days

Nov 15, 2019

Discovered

Dec 13, 2019

Filed

vs. sector median

15 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_072ad9aa7adecf142019-12-23 · +10dVerified

Name: HelloTech
norm: hellotech
Domain: hellotech.com

Name: HelloTech
norm: hellotech
Domain: hellotech.com
Industry: Technologyllm

Discovered: Nov 15, 2019
Materiality determined: —
Notification sent: Nov 15, 2019
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External

During the incident: Secured all of the data
Conducted an investigation to determine how the incident occurred and who was impacted
Reviewed our internal data management and protocols
Implemented enhanced security measures to help prevent such an incident from recurring
Arranged for you to enroll, at no cost to you, in an online credit monitoring service (myTrueIdentity) for one year provided by TransUnion Interactive
Changes made: Implemented enhanced security measures to help prevent such an incident from recurring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGDec 13 · first · this page

California State AG+10d

Pattern: first filing Dec 13 (MT), last Dec 23 (CA) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-94.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 13, 2019
Raw hash: 7dd5d87d9fa7ea5edb5cea58a995748d434e49252f04a9cd5b9d565d6293f1a6

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHelloTech

Victim entityHelloTech

Incidentdiscovered Nov 15, 2019

Stated responseSecured all of the data

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov