HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Financial accountIdentity (basic)PIILowContained

Green Roads of Florida

bd_752e3b0c7b79833b · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 16, 2019

Filed

Nov 14, 2019

To disclose

29 days

Affected

540state residents only

Linked

4 filings

Confidence

69%

Full breach record for Green Roads of Florida →

Green Roads of Florida, LLC reported a data breach affecting 540 Washington residents. Unauthorized access occurred via a compromised administrator account at an outsourced hosting provider between July 9 and October 9, 2019. Compromised data included names, credit card numbers, and expiration dates. The breach was discovered on October 16, 2019. Notices were sent on November 15, 2019, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 99 days

discovery → filing · 29 days

Jul 9, 2019

Begins

Oct 16, 2019

Discovered

Nov 14, 2019

Filed

vs. sector median

3 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_73c096f64f86bf9c2019-11-14Verified
Montana State AGbd_fd46116de4d1570d2019-11-14Verified
Massachusetts State AGbd_90103bf21e66d44e2019-11-20 · +6dVerified

Name: Smith, Geacgtrell & Russen, LLP
norm: smith geacgtrell russen

Name: Green Roads of Florida
norm: green roads of florida
Industry: Retail & Consumerllm

Discovered: Oct 16, 2019
Breach occurred: Jul 9, 2019 – Oct 9, 2019
Undetected for: 99 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 15, 2019
Affected individuals: 540state-resident count only
Data types: Financial accountIdentity (basic)PII
Data elements: NameFinancial account number
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Office of the Attorney General
Initial access: valid_credentials

During the incident: Restricted website administrative access
Changed all passwords
Installed continuous monitoring of all activity from Administrators
Increased monitoring of all out-bound data transfers
Offering identity theft protection services through ID Experts
Changes made: Implemented additional safeguards to improve data security on the company's website
Engaged a third-party auditor to perform an updated PCI GAP analysis
Remediation
Network scans
Penetration testing
Conduct a PCI audit
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGNov 14 · first

Montana State AGNov 14 · first

Washington State AGNov 14 · first · this page

Massachusetts State AG+6d

Pattern: first filing Nov 14 (CA), last Nov 20 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10416.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 14, 2019
Raw hash: d23a693f5980b1681ac5f5a63bf16236853db61547cdf3116cefbdeb4ed414ec

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySmith, Geacgtrell & Russen, LLP

Victim entityGreen Roads of Florida

Incidentdiscovered Oct 16, 2019

Stated responseRestricted website administrative access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com