HackingCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Drive Sally, LLC

bd_d5184303fdeea10b · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 1, 2024

Filed

Jun 5, 2024

To disclose

5 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for Drive Sally, LLC →

Drive Sally, LLC experienced unauthorized access to its staging database between April 30 and May 1, 2024. The company discovered the incident on May 1, 2024. Affected data may include names, driver's license numbers, and dates of birth. The incident has been contained, and the company has enhanced security measures and offered credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 1, 2024 → Notified Jun 5, 202435d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 5 weeks / 35 days

Apr 30, 2024

Begins

May 1, 2024

Discovered

Jun 5, 2024

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_ad10690f4868c9232024-06-05Verified
Maine State AGbd_d2c1cf11ccc2a3ad2024-06-05Candidate
Illinois State AGbd_fd035f02ac66aec82024-06-01 · +4dVerified

Name: Drive Sally, LLC
norm: drive sally
Domain: drivesally.com

Name: Drive Sally, LLC
norm: drive sally
Domain: drivesally.com

Discovered: May 1, 2024
Breach occurred: Apr 30, 2024 – May 1, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jun 5, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Contained the incident
Initiated an investigation
Notified law enforcement
Enhanced technical security measures
Changes made: Enhanced technical security measures
Offering complimentary one-year membership of Equifax Credit Watch Gold
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: CA 60-day OK · 35d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 1, 2024
→ Notified: Jun 5, 2024
35d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 1, 2024 → Notified: Jun 5, 2024	35d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Illinois State AGJun 1 · first

Indiana State AG+4d

Maine State AG+4d

California State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-586452
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 5, 2024
Raw hash: 37211ddd2bc94acf5dcaf22aa2ae80f00c4340cf14b468dfdcd038aba5b2d335

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityDrive Sally, LLC

Victim entityDrive Sally, LLC

Incidentdiscovered May 1, 2024

Stated responseContained the incident

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov