AccidentalTechnologyTransportation & LogisticsInformationMisconfigurationCustomer Data InvolvedIdentity (basic)PIILowContained

SafetyFirst

bd_8f41a95d9598b81d · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 2, 2014

Filed

Jun 13, 2014

To disclose

10 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for SafetyFirst →2 incidents on file

SafetyFirst disclosed that a configuration error during a routine upgrade made an FTP server publicly accessible, resulting in unauthorized access to drivers' personal information. The company became aware of the incident on April 2, 2014, and immediately disconnected the server. An independent forensics firm was engaged to investigate. SafetyFirst offered 12 months of identity protection to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 72 days

Apr 2, 2014

Discovered

Jun 13, 2014

Filed

vs. sector median

8 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_30548b845dcae8ab2014-06-10 · +3dVerified

Name: SafetyFirst
norm: safetyfirst
Domain: safetyfirst.com

Name: SafetyFirst
norm: safetyfirst
Domain: safetyfirst.com
Industry: TechnologyllmTransportation & Logisticsllm

Discovered: Apr 2, 2014
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)PII
Attack vector: Misconfiguration

During the incident: Immediately disconnected the FTP server to prevent further unauthorized access
Launched an investigation to determine what information was exposed and how the server was being accessed
Engaged the services of an independent forensics investigation firm
Reached out to certain websites that may have indexed or cached the accessed data and requested removal
Changes made: Offered 12 months of identity protection services through AllClear ID at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(72 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJun 10 · first

California State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-45481
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 13, 2014
Raw hash: dc0f7c149c521b6c7024526ead49ab44c13bfad12231976f09ca4768c0d2000c

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySafetyFirst

Victim entitySafetyFirst

Incidentdiscovered Apr 2, 2014

Stated responseImmediately disconnected the FTP server to prevent further unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov