HackingVulnerability ExploitTargetedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Lendio Partners, LLC
bd_7c18f944d7d34a27 · schema v1 · pii pii-v1
Full breach record for Lendio Partners, LLC →Lendio Partners, LLC notified consumers of a data breach discovered on May 2, 2023, where an unauthorized third party exploited a vulnerability in its loan application platform. The incident exposed names and individual taxpayer identification numbers. Lendio engaged a cybersecurity firm, notified law enforcement, and offered 24 months of Experian IdentityWorks services.
Vermont clock✗ VT AG >45 bday13 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_5740ad4404a7ac27Montana State AGfiled 2023-08-03Candidate
- bd_ccc49451ee1fe15cCalifornia State AGfiled 2023-08-04(1d gap)Verified
- bd_ccdffe08cee3a609New Hampshire State AGfiled 2023-08-07(4d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-08-03-lendio-partners-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 3, 2023
- Raw hash
- 440fb2b2077b893985b370d58dcaa1312fce0ebc4b22cefe091fc749d1bf224b
Reporting entity
- Name
- Lendio Partners, LLCnorm: lendio partners
- Domain
- lendio.com
Victim entity
- Name
- Lendio Partners, LLCnorm: lendio partners
- Domain
- lendio.com
Incident
- Discovered
- May 2, 2023
- Materiality determined
- —
- Notification sent
- Aug 3, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Notified law enforcement
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 13 weeks(93 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.