HackingTechnologyInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedHealth (basic)Identity (basic)Government IDPHIHighContained

HopSkipDrive

bd_b2ebd8b07b861faa · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 12, 2023

Filed

Jul 27, 2023

To disclose

6 weeks

Affected

14,757state residents only

Confidence

69%

Full breach record for HopSkipDrive →2 incidents on file

HopSkipDrive, Inc. reported a supplemental data security incident to the Washington AG. Unauthorized access occurred between May 31 and June 10, 2023, discovered on June 12, 2023. The incident impacted 14,757 Washington residents, exposing names, SSNs, DOBs, driver's licenses, DoD IDs, and medical information. Notifications were mailed starting November 14, 2023.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 12 days

discovery → filing · 6 weeks / 45 days

May 31, 2023

Begins

Jun 12, 2023

Discovered

Jul 27, 2023

Filed

vs. sector median

12 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed14,757 affectedView incident

Name: Pierson Ferdinand LLP
norm: pierson ferdinand
Domain: pierferd.com

Name: HopSkipDrive
norm: hopskipdrive
Domain: admin.hopskipqa.com
Industry: Technologyllm

Discovered: Jun 12, 2023
Breach occurred: May 31, 2023 – Jun 10, 2023
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 14, 2023
Affected individuals: 14,757state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: NameSocial Security numberDriver's licence numberDate of birthMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: reported the Incident to law enforcement
Initial access: exploit_public_facing

During the incident: Reported the Incident to law enforcement
Worked with cybersecurity counsel and forensic experts to investigate
Engaged experts to assist in assessing what information may have been impacted
Took steps to mitigate the potential impact to its community
Offered complimentary identity theft and credit monitoring services for twelve (12) months
Changes made: Strengthening its security posture
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16326.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 27, 2023
Raw hash: aa51fa7fd488d66c4f2b5795bc167a21194ce693a61bdb13d903cea7663592e0

Reporting entityPierson Ferdinand LLP

Victim entityHopSkipDrive

Incidentdiscovered Jun 12, 2023

Stated responseReported the Incident to law enforcement

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com