AccidentalRetail & ConsumerRetailMisconfigurationData MishandlingSupply Chain (3P Vendor)Employee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

QVALE AUTO GROUP, INC.

bd_a21d90b790bb1c4e · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Oct 10, 2016

To disclose

—

Affected

Not disclosed

Confidence

73%

Full breach record for QVALE AUTO GROUP, INC. →

Qvale Auto Group, Inc. notified employees of a data exposure that occurred in June 2016 during a third-party IT vendor's system upgrade. Employee access limitations were inadvertently removed, allowing certain employees to potentially view other employees' names, bank account information, and Social Security Numbers. The error was corrected upon discovery. Affected employees were offered 12 months of Experian ProtectMyID credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 27, 2016

Begins

Oct 10, 2016

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: QVALE AUTO GROUP, INC.
norm: qvale auto

Name: QVALE AUTO GROUP, INC.
norm: qvale auto
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Jun 27, 2016
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Third-Party / Supply Chain
Threat actor: Partner

During the incident: Immediately began investigating the incident
Conducting a forensic examination
Taking other actions internally to minimize the risk of harm and reoccurrence
Offering complimentary one-year membership of Experian's ProtectMyID Alert
Changes made: Access limitations were corrected as soon as the error was discovered
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-64308
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 10, 2016
Raw hash: 3e8fd3ab7e0b25befd7c99217ab8610ddc46c27321156a358dc66ebf88f3ff79

Reporting entityQVALE AUTO GROUP, INC.

Victim entityQVALE AUTO GROUP, INC.

IncidentThird-Party / Supply Chain

Stated responseImmediately began investigating the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov