HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPIIHighActive

Progressive Leasing

bd_6e9645f368f8433a · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 11, 2023

Filed

Oct 24, 2023

To disclose

6 weeks

Affected

4,436state residents only

Linked

10 filings

Confidence

64%

Full breach record for Progressive Leasing →2 incidents on file

Progressive Leasing notified South Carolina residents of a data breach where an unauthorized third party accessed the network starting September 9, 2023. Personal information including names, SSNs, DOBs, and addresses of customers and employees was accessed. The company engaged cybersecurity experts and notified law enforcement. Affected individuals are offered 12 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due6 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 2 days

discovery → filing · 6 weeks / 43 days

Sep 9, 2023

Begins

Sep 11, 2023

Discovered

Oct 24, 2023

Filed

vs. sector median

2 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Washington State AGbd_2047ab3d4f323b6c2023-10-24Verified
Montana State AGbd_1d1b9dd739810e982023-10-23 · +1dVerified
Oregon State AGbd_2343ba4ecbd94ae82023-10-23 · +1dVerified
Maine State AGbd_31d8aa8dacf4c1cb2023-10-23 · +1dVerified

Show 5 more filings ↓up to 33d gap

Delaware State AGbd_acf2552b7336114e2023-10-23 · +1dVerified
Massachusetts State AGbd_bef96dbb3ba948a42023-10-23 · +1dVerified
California State AGbd_9c14cbb322c102712023-10-22 · +2dVerified
New Hampshire State AGbd_707166e8373b559a2023-10-30 · +6dVerified
SEC 8-Kbd_981201c9f13646f02023-09-21 · +33dCandidate

Name: Progressive Leasing
norm: progressive leasing
Domain: progleasing.com

Name: Progressive Leasing
norm: progressive leasing
Domain: progleasing.com
Industry: Financial Servicesllm

Discovered: Sep 11, 2023
Breach occurred: Sep 9, 2023
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 23, 2023
Affected individuals: 4,436state-resident count only
Data types: Identity (basic)Government IDPII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: valid_credentials

During the incident: Engaged leading cybersecurity experts
Launched an investigation
Notified law enforcement
Secured our network environment
Hired cybersecurity experts to assist us in our investigation and containment
Offered complimentary credit and identity monitoring services through Experian
Changes made: Working with cybersecurity experts to continue to strengthen our security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

SEC 8-KSep 21 · first

California State AG+31d

Montana State AG+32d

Oregon State AG+32d

Maine State AG+32d

Delaware State AG+32d

Massachusetts State AG+32d

Washington State AG+33d

South Carolina State AG+33d · this page

New Hampshire State AG+39d

Pattern: first filing Sep 21, last Oct 30 (NH) — a 39-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ProgressiveLeasing.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 24, 2023
Raw hash: 3ad8281f58d7fbfe35547ae96b9bbae217ad465a227abb5fb8bbd323f15d8a37

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityProgressive Leasing

Victim entityProgressive Leasing

Incidentdiscovered Sep 11, 2023

Stated responseEngaged leading cybersecurity experts

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov