HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTMediumContained
Divvy
bd_c0c5e3cb53ac3092 · schema v1 · pii pii-v1
Full breach record for Divvy →Divvy Up, Inc. reported an external system breach (hacking) occurring between December 1, 2020, and March 8, 2021, discovered on March 10, 2021. The incident affected 46,958 individuals, including 185 Maine residents. Acquired data included names and financial account or credit/debit card numbers (with security codes/PINs). Written notifications were sent on May 3, 2021. No identity theft protection services were offered.
Maine clockDiscovered Mar 10, 2021 → Filed with AG May 4, 202155d ⏱ ME AG >30d8 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_3e0b7231e130092bOregon State AGfiled 2021-05-03(1d gap)Candidate
- bd_3fb2bd19bcf8bf84Montana State AGfiled 2021-05-03(1d gap)Verified
- bd_6a530a38e06eba6bCalifornia State AGfiled 2021-05-03(1d gap)Verified
- bd_8fc9f6edf9594d0bWashington State AGfiled 2021-05-03(1d gap)Verified
Show 1 more filing ↓Show fewer ↑up to 1d gap
- bd_f2b3150d821352fbWashington State AGfiled 2021-05-03(1d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/2d5185fe-4dde-40ed-9980-bd6ec122d243.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 4, 2021
- Raw hash
- d35d94251009c2d634179b703316898ad83ca4e4bd100fa6607737ab91a11355
Reporting entity
- Name
- Divvynorm: divvy
- Domain
- divvy.app
Victim entity
- Name
- Divvynorm: divvy
- Domain
- divvy.app
Incident
- Discovered
- Mar 10, 2021
- Materiality determined
- —
- Notification sent
- May 3, 2021
- Affected individuals
- 46,958
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified consumer reporting agencies (as Maine residents > 1,000)
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 8 weeks(55 days from discovery to filing)
- Compliance flags
- ME AG >30d · 55d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Mar 10, 2021→ Filed with AG: May 4, 202155d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.