HackingTransportation & LogisticsTransportationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDCritical

HopSkipDrive

bd_d815966810d8f753 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jun 12, 2023

Filed

Feb 2, 2024

To disclose

34 weeks

Affected · nationwide

155,39459 in this filing

Linked

6 filings

Confidence

65%

Full breach record for HopSkipDrive →2 incidents on file

HopSkipDrive, Inc. reported an external system breach that occurred on May 31, 2023, and was discovered on June 12, 2023. The incident affected 155,394 individuals, exposing their names and driver's license or non-driver identification card numbers. The company began notifying affected individuals in writing on November 14, 2023, and offered 12 months of complimentary credit monitoring and identity theft protection services through TransUnion.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 12, 2023 → Filed with AG Feb 2, 2024235d ✗ ME AG >90d34 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 12 days

discovery → filing · 34 weeks / 235 days

May 31, 2023

Begins

Jun 12, 2023

Discovered

Feb 2, 2024

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_0effe01819aaca822024-02-02Candidate
California State AGbd_4d28f1139039e4522024-02-02Verified
Massachusetts State AGbd_2c4bfd8dbf0df0832024-02-03 · +1dVerified
Vermont State AGbd_5b9dbc45bc576fc82024-02-03 · +1dVerified

Show 1 more filing ↓up to 1d gap

Illinois State AGbd_b11da8949437e91e2024-02-01 · +1dVerified

Name: HopSkipDrive
norm: hopskipdrive
Domain: admin.hopskipqa.com

Name: HopSkipDrive
norm: hopskipdrive
Domain: admin.hopskipqa.com
Industry: Transportation & Logisticsllm

Discovered: Jun 12, 2023
Breach occurred: May 31, 2023
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 14, 2023
Affected individuals: 155,394state + nationwide
Data types: Identity (basic)Government ID
Data elements: Driver's licence number
Attack vector: Unauthorized Access
Threat actor: External

During the incident: Offered 12 months of credit monitoring and identity theft protection services via TransUnion.
Sent written notification to affected consumers on 11/14/2023; 12/11/2023; 01/10/2024
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 34 weeks(235 days from discovery to filing)
Compliance flags: ME AG >90d · 235dME resident >60d · 155d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 12, 2023
→ Filed with AG: Feb 2, 2024
235d 90 days ME AG >90d
Maine
Discovered: Jun 12, 2023
→ Notified: Nov 14, 2023
155d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 12, 2023 → Filed with AG: Feb 2, 2024	235d	90 days	ME AG >90d
Maine	Discovered: Jun 12, 2023 → Notified: Nov 14, 2023	155d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGFeb 1 · first

Montana State AG+1d

California State AG+1d

Maine State AG+1d · this page

Massachusetts State AG+2d

Vermont State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/ef8f5f1f-b7d2-4c86-90b8-cf8487bc80b0.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 2, 2024
Raw hash: 9373f388001db8589aef97814706d9fa9518f07837798b4510ce4eda3cac8547

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityHopSkipDrive

Victim entityHopSkipDrive

Incidentdiscovered Jun 12, 2023

Stated responseOffered 12 months of credit monitoring and identity theft protection services via TransUnion.

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov