HackingTechnologyInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedPIILowContained

SHIFT TECHNOLOGIES, INC.

bd_bd7750ed742ec875 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 18, 2020

Filed

Jan 14, 2021

To disclose

17 weeks

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for SHIFT TECHNOLOGIES, INC. →

Shift Technologies, Inc. notified Montana residents of a third-party vendor breach. Unauthorized access to cloud storage occurred on September 17, 2020, discovered on September 18, 2020. Personal information may have been accessed. Forensic investigators were engaged, and security measures enhanced. Identity monitoring services offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 17 weeks / 118 days

Sep 17, 2020

Begins

Sep 18, 2020

Discovered

Jan 14, 2021

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_33cb39d5a96cf11d2021-01-14Verified
Indiana State AGbd_69bcbae01f029b662021-01-14Verified

Name: SHIFT TECHNOLOGIES, INC.
norm: shift technologies

Name: SHIFT TECHNOLOGIES, INC.
norm: shift technologies
Industry: Technologyllm

Discovered: Sep 18, 2020
Breach occurred: Sep 17, 2020
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: PII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Initial access: trusted_relationship

During the incident: Engaged forensic investigators to assess what occurred
Made changes to our system to prevent that unauthorized party from further accessing our systems
Changes made: Enhancing existing security program
Implementing multiple layers of protective measures
Ensuring best practices in the security of data storage
Re-educating staff in proper handling of secure data
Offering complimentary membership in Experian’s IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(118 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGJan 14 · first

Indiana State AGJan 14 · first

Montana State AGJan 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/shiftSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 14, 2021
Raw hash: e2a69249340ae88f7e9be2f40bbe1fa4d0fcf60dc9d2d64158c1201f2ec2f8f9

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySHIFT TECHNOLOGIES, INC.

Victim entitySHIFT TECHNOLOGIES, INC.

Incidentdiscovered Sep 18, 2020

Stated responseEngaged forensic investigators to assess what occurred

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov