HackingVulnerability ExploitCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Lendio Partners, LLC
bd_ccc49451ee1fe15c · schema v1 · pii pii-v1
Full breach record for Lendio Partners, LLC →Lendio Partners, LLC disclosed that an unauthorized third party exploited a vulnerability in its website loan application platform to access borrower information, including names and individual taxpayer identification numbers. The incident was discovered on May 2, 2023. Lendio addressed the vulnerability, notified law enforcement, and engaged a cybersecurity firm. Affected individuals are offered 24 months of Experian IdentityWorks.
California clockDiscovered May 2, 2023 → Notified Aug 3, 202393d ✗ CA 60-day late13 weeks discovery → filing
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_5740ad4404a7ac27Montana State AGfiled 2023-08-03(1d gap)Candidate
- bd_7c18f944d7d34a27Vermont State AGfiled 2023-08-03(1d gap)Verified
- bd_ccdffe08cee3a609New Hampshire State AGfiled 2023-08-07(3d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-571333
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 4, 2023
- Raw hash
- ebf1c8fa4f6be440170d64ef87d82c6f43b03af0d05837533d66bea2982e77af
Reporting entity
- Name
- Lendio Partners, LLCnorm: lendio partners
- Domain
- lendio.com
Victim entity
- Name
- Lendio Partners, LLCnorm: lendio partners
- Domain
- lendio.com
Incident
- Discovered
- May 2, 2023
- Materiality determined
- —
- Notification sent
- Aug 3, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Notified law enforcement
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 13 weeks(94 days from discovery to filing)
- Compliance flags
- CA 60-day late · 93d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: May 2, 2023→ Notified: Aug 3, 202393d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.