MalwareRetail & ConsumerRetailRansomwareData EncryptedTargetedIdentity (basic)Government IDHighContained

Tuttle-Click Automotive Group

bd_a02f44ca35536262 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 29, 2024

Filed

Sep 19, 2024

To disclose

7 weeks

Affected · nationwide

6,0121 in this filing

Linked

6 filings

Confidence

66%

Full breach record for Tuttle-Click Automotive Group →

Tuttle-Click Automotive Group reported an external system breach (hacking) resulting in malware encryption of systems. Unauthorized access likely occurred between Nov 24, 2023 and Dec 5, 2023. The incident was discovered on July 29, 2024. Data involved names and Social Security numbers. 6,012 individuals were affected, including 1 Maine resident. Notices were sent on Sept 19, 2024, offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jul 29, 2024 → Filed with AG Sep 19, 202452d ⏱ ME AG >30d7 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 248 days

discovery → filing · 7 weeks / 52 days

Nov 24, 2023

Begins

Jul 29, 2024

Discovered

Sep 19, 2024

Filed

vs. sector median

on median

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_1ed407818229b8a32024-09-19Candidate
Indiana State AGbd_2cce3717c9e0beb42024-09-19Verified
New Hampshire State AGbd_7ab0b90e83a618202024-09-19Verified
Montana State AGbd_d6c366e55cd3f63a2024-09-19Verified

Show 1 more filing ↓up to 1d gap

Massachusetts State AGbd_595b2118c14d8a6f2024-09-20 · +1dVerified

Name: Tuttle-Click Automotive Group
norm: tuttle click automotive
Domain: tuttleclick.com

Name: Tuttle-Click Automotive Group
norm: tuttle click automotive
Domain: tuttleclick.com
Industry: Retail & Consumerllm

Discovered: Jul 29, 2024
Breach occurred: Nov 24, 2023 – Dec 5, 2023
Undetected for: 248 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 19, 2024
Affected individuals: 6,012state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcementProviding written notice of this incident to relevant state regulators
Initial access: external_remote_services

During the incident: Moved systems offline
Ensured the security of the network
Launched an investigation into the nature and scope of the event
Notified federal law enforcement
Provided access to credit monitoring services for 2 years, through IDX
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state regulators
Providing written notice to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Working to implement additional safeguards, security tools, and training to its employees
Reviewed our policies, procedures, and security tools to reduce the risk of a similar event from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: ME AG >30d · 52d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jul 29, 2024
→ Filed with AG: Sep 19, 2024
52d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jul 29, 2024 → Filed with AG: Sep 19, 2024	52d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

California State AGSep 19 · first

Indiana State AGSep 19 · first

New Hampshire State AGSep 19 · first

Montana State AGSep 19 · first

Maine State AGSep 19 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/e67550f1-9a1e-4b4a-9c88-35027cdaca28.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 19, 2024
Raw hash: d7e49cd763059ee2af2d2be10deff032302e6bfcdce367c1c54907866c543c63

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityTuttle-Click Automotive Group

Victim entityTuttle-Click Automotive Group

Incidentdiscovered Jul 29, 2024

Stated responseMoved systems offline

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov