HackingFinancial ServicesTechnologyFinanceSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDHighContained

Stripe GEP, Inc.

bd_9d6a179edc0c075c · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 11, 2019

Filed

Dec 31, 2019

To disclose

20 days

Affected

2,670

Linked

2 filings

Confidence

65%

Full breach record for Stripe GEP, Inc. →

Stripe GEP, Inc. notified individuals that their personal information, including names and Social Security numbers, may have been accessed by an unknown third party due to a security vulnerability in the document storage system of its service provider, Legalinc Corporate Services Inc. The incident affected approximately 2,670 individuals who used the Stripe Atlas service. The vulnerability existed between October 25, 2017, and December 4, 2019. Stripe discovered the issue on December 11, 2019. Legalinc has addressed the vulnerability. Stripe is offering one year of complimentary credit monitoring and identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 777 days

discovery → filing · 20 days

Oct 25, 2017

Begins

Dec 11, 2019

Discovered

Dec 31, 2019

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_e0637c912610d8ff2019-12-31Candidate

Name: Stripe GEP, Inc.
norm: stripe gep

Name: Stripe GEP, Inc.
norm: stripe gep
Industry: Financial ServicesllmTechnologyllm

Discovered: Dec 11, 2019
Breach occurred: Oct 25, 2017 – Dec 4, 2019
Undetected for: 777 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2,670nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via Legalinc Corporate Services Inc.
Initial access: supply_chain

During the incident: Began investigating the incident as soon as we learned of it in coordination with our service provider Legalinc
Examining the measures we can take to help prevent incidents of this kind in the future
Arranged for you, at your option, to enroll in a complimentary one-year credit monitoring and identity protection service
Changes made: Legalinc has since taken appropriate measures to address the vulnerability in its data-storage system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGDec 31 · first

California State AGDec 31 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-185511
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 31, 2019
Raw hash: 6df72c615d50e8f3c3105fe4db635b56be7b5d686c0d2feeb330a3dcc8cf2a87

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityStripe GEP, Inc.

Victim entityStripe GEP, Inc.

Incidentdiscovered Dec 11, 2019

Stated responseBegan investigating the incident as soon as we learned of it in coordination with our service provider Legalinc

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov