MalwareFinancial ServicesFinanceRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Industrial Acceptance Corporation

bd_8f552868d4b21725 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 24, 2025

Filed

Jun 1, 2026

To disclose

15 months

Affected

679state residents only

Linked

11 filings

Confidence

69%

Full breach record for Industrial Acceptance Corporation →

Industrial Acceptance Corporation, an auto financing firm, reported a ransomware incident to Washington AG. Unauthorized access occurred Feb 22-24, 2025, discovered Feb 24. Files were exfiltrated around March 4, 2025. 679 Washington residents affected; data included names, SSNs, and DOBs. Notifications sent May 28, 2026. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d15 months discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 2 days

discovery → filing · 15 months / 462 days

Feb 22, 2025

Begins

Feb 24, 2025

Discovered

Jun 1, 2026

Filed

vs. sector median

+58 wks slower

This filing is one of 11 about the same incident.View merged incident

A leak claim by akira about this victim predates this filing by 459 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteakirabd_09c40eae3676c1962025-02-27 · +459dCandidate

Regulatory filings (9) · sorted by filing gap

Vermont State AGbd_95d220c931e3ba952026-06-01Verified
Texas State AGbd_79cfa0ac16eea4542026-05-29 · +3dVerified
Massachusetts State AGbd_b48acdbe47a03a882026-05-29 · +3dVerified
Maine State AGbd_db8fcb8b8729724b2026-05-29 · +3dVerified

Show 5 more filings ↓up to 31d gap

Nebraska State AGbd_5744e8fd9f6330db2026-05-28 · +4dVerified
California State AGbd_64f9be54f5cdd9c62026-05-28 · +4dVerified
New Hampshire State AGbd_aa16cbe2fb05315d2026-05-28 · +4dVerified
Indiana State AGbd_ab7b0ef963d42cb72026-05-28 · +4dVerified
Illinois State AGbd_1406d214a2334d6b2026-05-01 · +31dCandidate

Name: Kennedys CMK LLP
norm: kennedys cmk

Name: Industrial Acceptance Corporation
norm: industrial acceptance
Domain: iaccredit.com
Industry: Financial Servicesllm

Discovered: Feb 24, 2025
Breach occurred: Feb 22, 2025 – Feb 24, 2025
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 28, 2026
Affected individuals: 679state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security numberDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington State Attorney General

During the incident: Took its systems offline to secure them
Retaining our law firm
Engaged a digital forensics incident response firm to assist with our rendering of legal advice
Reported the event to federal law enforcement
Offering 12 months of complimentary credit monitoring and identity protection services through Cyberscout, a TransUnion company
Changes made: Reviewing its existing security policies and protections already in place on its network for additional ways to safeguard against evolving threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(462 days from discovery to filing)
Compliance flags: WA AG >90dLeak >180d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGMay 1 · first

Nebraska State AG+27d

California State AG+27d

New Hampshire State AG+27d

Indiana State AG+27d

Texas State AG+28d

Massachusetts State AG+28d

Maine State AG+28d

Vermont State AG+31d

Washington State AG+31d · this page

Pattern: first filing May 1 (IL), last Jun 1 (WA) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41141.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 1, 2026
Raw hash: d98b5a71642f19374a5deb53228115a4f699cceea09ee6e31f3c67ec7a3f6599

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityKennedys CMK LLP

Victim entityIndustrial Acceptance Corporation

Incidentdiscovered Feb 24, 2025

Stated responseTook its systems offline to secure them

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com