AccidentalFinancial ServicesFinanceProgramming ErrorCustomer Data InvolvedCredentialsIdentity (basic)LowResolved

ALLY FINANCIAL INC.

bd_a5f5a019f85d480f · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 12, 2021

Filed

Jun 15, 2021

To disclose

9 weeks

Affected

Not disclosed

Confidence

66%

Full breach record for ALLY FINANCIAL INC. →3 incidents on file

Ally Financial Inc disclosed a programming code error during a routine website update on February 18, 2021, which inadvertently exposed customer usernames and passwords to third-party business partners. The company detected the error on April 12, 2021, immediately locked affected accounts, updated the code, and required password resets. No fraudulent activity was found. Equifax credit monitoring was offered to affected customers.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 53 days

discovery → filing · 9 weeks / 64 days

Feb 18, 2021

Begins

Apr 12, 2021

Discovered

Jun 15, 2021

Filed

vs. sector median

+1 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: ALLY FINANCIAL INC.
norm: ally financial
Domain: ally.com

Name: ALLY FINANCIAL INC.
norm: ally financial
Domain: ally.com
Industry: Financial Servicesllm

Discovered: Apr 12, 2021
Breach occurred: Feb 18, 2021
Undetected for: 53 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: CredentialsIdentity (basic)
Attack vector: Unknown

During the incident: Immediately locked your account password(s)
Reviewed your account(s) and found no indication of fraudulent activity
Continued to monitor your Ally accounts daily
Immediately updated the programming code to ensure it no longer included username and password information
Engaged Equifax to provide credit monitoring and identity theft insurance
Changes made: Updated the programming code to ensure it no longer included username and password information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-541863
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 15, 2021
Raw hash: 86439193b9b858c0127e86b4656c4a7e1ec14925c9bb51d8af62003b8da2c8e7

Reporting entityALLY FINANCIAL INC.

Victim entityALLY FINANCIAL INC.

Incidentdiscovered Apr 12, 2021

Stated responseImmediately locked your account password(s)

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov