HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedMulti-Stage ChainGovernment IDFinancial accountIdentity (basic)MediumActive

Tully Automotive Group

bd_6675c75a47f07b09 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 19, 2016

Filed

Sep 22, 2016

To disclose

3 days

Affected · nationwide

4339 in this filing

Confidence

67%

Full breach record for Tully Automotive Group →

Tully Automotive Group notified NH AG of a data incident on Sept 19, 2016, where an unauthorized person accessed payroll records via vendor Paylocity using employee credentials. 4 individuals affected (39 NH residents listed in error in text vs 4 total). Data included SSN, bank info. Police notified, credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 3 days

Sep 19, 2016

Discovered

Sep 22, 2016

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed43 affectedView incident

Name: Tully Automotive Group
norm: tully automotive

Name: Tully Automotive Group
norm: tully automotive
Industry: Retail & Consumerllm

Discovered: Sep 19, 2016
Materiality determined: —
Notification sent: Sep 22, 2016
Affected individuals: 43state + nationwide
Data types: Government IDFinancial accountIdentity (basic)
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: valid_credentials

During the incident: Contacted Paylocity and the Nashua Police to investigate
Changed passwords
Limited access to suspicious IP addresses
Tightened Paylocity access management protocols
Provided an initial alert to all employees
Providing 12 months of credit monitoring services at no cost
Changes made: Reexamining its current data privacy and security policies and procedures
Retraining employees about email best practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 3 days(3 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/tulley-automotive-20160922.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 22, 2016
Raw hash: 3a3e35284e1e84c58d4cc4d7ebd1ee074f52d0ad06ec1a3868f24c6b719747fb

Reporting entityTully Automotive Group

Victim entityTully Automotive Group

Incidentdiscovered Sep 19, 2016

Stated responseContacted Paylocity and the Nashua Police to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov