UnknownRetail & ConsumerRetailCustomer Data InvolvedIdentity (basic)LowContained

Soapy Joe's Car Wash

bd_9b8dbc80b8251ca4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 6, 2025

Filed

Dec 29, 2025

To disclose

12 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Soapy Joe's Car Wash →

Soapy Joe’s Car Wash reported a data security incident discovered on October 6, 2025, involving unusual activity on its corporate network. An unauthorized actor may have obtained data including names and other personal information. The company secured the network, launched an investigation, and implemented additional security measures. Affected individuals were offered complimentary identity protection services through Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 84 days

Oct 6, 2025

Begins

Oct 6, 2025

Discovered

Dec 29, 2025

Filed

vs. sector median

+4 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteakirabd_b28da7dec22bfb3a2025-10-05 · +85dVerified by operator

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_8a0758ad0ab1260a2025-12-29Verified

Name: Soapy Joe's Car Wash
norm: soapy joe s car wash
Domain: soapyjoescarwash.com

Name: Soapy Joe's Car Wash
norm: soapy joe s car wash
Domain: soapyjoescarwash.com
Industry: Retail & Consumerllm

Discovered: Oct 6, 2025
Breach occurred: Oct 6, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 29, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unknown
Threat actor: External

During the incident: Took immediate measures to secure the network
Launched an investigation to evaluate what happened and what information may have been involved
Implemented additional security measures to minimize the risk of a similar incident occurring in the future
Offering complimentary identity protection services through Experian
Changes made: Implemented additional security measures to minimize the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(84 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGDec 29 · first

California State AGDec 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-616370
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 29, 2025
Raw hash: 1f19f6e3fa435ed98285efb8b28b1721caa47c8acfef878482c8b7e7cf3a0fea

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entitySoapy Joe's Car Wash

Victim entitySoapy Joe's Car Wash

Incidentdiscovered Oct 6, 2025

Stated responseTook immediate measures to secure the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov