MalwareFinancial ServicesFinanceRansomwareStolen CredentialsRansom DemandedData ExfiltratedTargetedIdentity (basic)Government IDMediumContained

AUTOPAY Direct, Inc.

bd_d2c472e50e865641 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 5, 2022

Filed

Mar 31, 2022

To disclose

8 weeks

Affected

37state residents only

Linked

8 filings

Confidence

65%

Full breach record for AUTOPAY Direct, Inc. →2 incidents on file

AUTOPAY Direct, Inc. notified Montana residents of a ransomware incident where a threat actor infiltrated the network, exfiltrated PII (names, SSNs, driver's licenses, DOBs), and demanded ransom. The breach occurred from Oct 11, 2021, to Feb 5, 2022. AUTOPAY engaged forensic investigators, notified law enforcement, terminated access, and implemented MFA and enhanced security controls.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 117 days

discovery → filing · 8 weeks / 54 days

Oct 11, 2021

Begins

Feb 5, 2022

Discovered

Mar 31, 2022

Filed

vs. sector median

2 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Indiana State AGbd_e1528908ef61677d2022-04-11 · +11dVerified
Washington State AGbd_27c3947e62aa6b162022-04-14 · +14dVerified
South Carolina State AGbd_2c0e299e2e7ca1b02022-04-14 · +14dVerified
Maine State AGbd_702f47d2350c448f2022-04-14 · +14dVerified

Show 3 more filings ↓up to 89d gap

New Hampshire State AGbd_07d252a1f53fa0562022-04-18 · +18dVerified
California State AGbd_29d55959bdbcd9252022-04-26 · +26dVerified
Illinois State AGbd_2e2021ad759667742022-01-01 · +89dCandidate

Name: AUTOPAY Direct, Inc.
norm: autopay direct

Name: AUTOPAY Direct, Inc.
norm: autopay direct
Industry: Financial Servicesllm

Discovered: Feb 5, 2022
Breach occurred: Oct 11, 2021 – Feb 5, 2022
Undetected for: 117 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 5, 2022
Affected individuals: 37state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: valid_credentials

During the incident: Notifying law enforcement
Successfully terminating all unauthorized access
Undertaking a full forensic investigation of the incident
Changes made: Implementing multifactor authentication for all users across the organization
Configuring additional security measures on our information technology platforms (including enhanced password management, access control restrictions and updated logging capabilities)
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+89d · this page

Indiana State AG+100d

Washington State AG+103d

South Carolina State AG+103d

Maine State AG+103d

New Hampshire State AG+107d

California State AG+115d

Pattern: first filing Jan 1 (IL), last Apr 26 (CA) — a 115-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-443.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 31, 2022
Raw hash: c39457b73503ea969a66a7646eca841885d35751545bf050c3b43b22ea95e125

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityAUTOPAY Direct, Inc.

Victim entityAUTOPAY Direct, Inc.

Incidentdiscovered Feb 5, 2022

Stated responseNotifying law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov