FEDERALItem 8.01 · voluntaryUnknownFinancial ServicesFinanceCustomer Data InvolvedPIIGovernment IDMediumActive

Progressive Leasing

bd_981201c9f13646f0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Sep 21, 2023

To disclose

—

Affected

Not disclosed

Linked

10 filings

Confidence

68%

Full breach record for Progressive Leasing →2 incidents on file

PROG Holdings, Inc. reported a cybersecurity incident at its Progressive Leasing subsidiary. The investigation is ongoing, involving PII including SSNs of customers. The company engaged third-party experts and notified law enforcement. No material financial impact is currently expected.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Sep 21, 2023

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

California State AGbd_9c14cbb322c102712023-10-22 · +31dVerified
Montana State AGbd_1d1b9dd739810e982023-10-23 · +32dVerified
Oregon State AGbd_2343ba4ecbd94ae82023-10-23 · +32dVerified
Maine State AGbd_31d8aa8dacf4c1cb2023-10-23 · +32dVerified

Show 5 more filings ↓up to 39d gap

Delaware State AGbd_acf2552b7336114e2023-10-23 · +32dVerified
Massachusetts State AGbd_bef96dbb3ba948a42023-10-23 · +32dVerified
Washington State AGbd_2047ab3d4f323b6c2023-10-24 · +33dVerified
South Carolina State AGbd_6e9645f368f8433a2023-10-24 · +33dVerified
New Hampshire State AGbd_707166e8373b559a2023-10-30 · +39dVerified

Name: PROG Holdings, Inc.
norm: prog holdings
SEC CIK: 0001808834

Name: Progressive Leasing
norm: progressive leasing
Domain: progleasing.com
Also named: PROG Holdings, Inc.operating subsidiary ofholding company
Industry: Financial Servicesllm

Discovered: —
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIGovernment ID
Attack vector: Unknown
Regulator citations: Will provide notice to regulatory authorities in accordance with applicable laws

During the incident: Engaged leading third-party cybersecurity experts
Took immediate steps to respond to, remediate and investigate the incident
Law enforcement was also notified
Changes made: Working with its third-party cybersecurity experts, to further harden its systems to protect against future incidents
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

SEC 8-KSep 21 · first · this page

California State AG+31d

Montana State AG+32d

Oregon State AG+32d

Maine State AG+32d

Delaware State AG+32d

Massachusetts State AG+32d

Washington State AG+33d

South Carolina State AG+33d

New Hampshire State AG+39d

Pattern: first filing Sep 21, last Oct 30 (NH) — a 39-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1808834/000119312523239623/
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Sep 21, 2023
Raw hash: 437f6be6b512b31dd66cdd0cf71cfdf266926d82fc2de5c4da4a16f12f3b7648

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html26.3 KB

Download View at source

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityPROG Holdings, Inc.

Victim entityProgressive Leasing

IncidentUnknown

Stated responseEngaged leading third-party cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing