AccidentalMisdeliverySupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTEMPLOYMENTMediumResolved
Ally Bank
bd_878db5401a7b6aac · schema v1 · pii pii-v1
Full breach record for Ally Bank →Ally Bank notified California residents that a third-party supplier inadvertently transmitted files containing personal information (including SSNs, credit scores, and employment data) to another financial institution in November 2018. The error was discovered in November 2018. The receiving institution deleted the files. Ally Bank offered two years of complimentary credit monitoring through Equifax.
California clockDiscovered Nov 1, 2018 → Notified Dec 12, 201841d ✓ CA 60-day OK6 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-142630
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 13, 2018
- Raw hash
- 2e99cc8b3e449ce6ba224fe9d4b7afef7c80a5ab693ee5f2adb3f823257264b5
Reporting entity
- Name
- Ally Banknorm: ally bank
Victim entity
- Name
- Ally Banknorm: ally bank
Incident
- Discovered
- Nov 1, 2018
- Materiality determined
- —
- Notification sent
- Dec 12, 2018
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTEMPLOYMENT
- Attack vector
- Third-Party / Supply Chain
- Threat actor
- Partner
- Third party
- via third-party supplier
- Initial access
- trusted_relationship
Compliance
- Time to disclose
- 6 weeks(42 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 41d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Nov 1, 2018→ Notified: Dec 12, 201841d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.