HackingFinancial ServicesFinanceStolen CredentialsPhishingSupply Chain (3P Vendor)Data ExfiltratedData PublishedIdentity (basic)Government IDCredentialsHighContained

DAVE INC.

bd_d96b710b910f0da4 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 1, 2020

Filed

Aug 21, 2020

To disclose

7 weeks

Affected

4,806state residents only

Linked

7 filings

Confidence

66%

Full breach record for DAVE INC. →

Dave, Inc. notified the NH Attorney General of a data breach involving ~4,806 NH residents. Unauthorized access occurred June 23–July 1, 2020, via a third-party service provider compromise. Exposed data included names, contact info, SSNs (encrypted), and hashed passwords. Dave engaged forensics, notified the FBI, reset credentials, and offered identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 8 days

discovery → filing · 7 weeks / 51 days

Jun 23, 2020

Begins

Jul 1, 2020

Discovered

Aug 21, 2020

Filed

vs. sector median

1 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Indiana State AGbd_0a9d0fa37812e2742020-08-21Verified
Delaware State AGbd_e092890dc5d3fb2a2020-08-21Verified
Washington State AGbd_5e95299fb85377f62020-08-20 · +1dVerified
California State AGbd_96afc6c3b4dc3c742020-08-20 · +1dVerified

Show 2 more filings ↓up to 233d gap

Oregon State AGbd_ea97508608d294232020-08-20 · +1dVerified
Illinois State AGbd_f91f5bf7f513a8f62020-01-01 · +233dCandidate

Name: DAVE INC.
norm: dave

Name: DAVE INC.
norm: dave
Industry: Financial Servicesllm

Discovered: Jul 1, 2020
Breach occurred: Jun 23, 2020 – Jul 1, 2020
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 21, 2020
Affected individuals: 4,806state-resident count only
Data types: Identity (basic)Government IDCredentials
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney GeneralNotified the Federal Bureau of Investigation (“ FBI”)
Initial access: supply_chain

During the incident: Dave’s security team quickly took steps to secure the company’s systems, including its customers’ accounts
Immediately began an investigation
Retained a leading cybersecurity firm
Notified law enforcement, including the Federal Bureau of Investigation (“ FBI”)
Changes made: No longer working with the third- party service provider
Forced a reset of all customer login credentials
Requiring all customers to change their passwords
Advising customers to change passwords on any other sites where they used the password they had previously used with Dave
Put in place additional technical measures to enhance account security
Made arrangements for potentially affected customers to receive complimentary identity theft protection services through December 31, 2021
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(51 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Illinois State AGJan 1 · first

Washington State AG+232d

California State AG+232d

Oregon State AG+232d

Indiana State AG+233d

Delaware State AG+233d

New Hampshire State AG+233d · this page

Pattern: first filing Jan 1 (IL), last Aug 21 (NH) — a 233-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/dave-20200821.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 21, 2020
Raw hash: 7828e02b4661192ab0722e3bfbc3ba89ee8a0d3239ec752a73a38284ecb62fa3

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityDAVE INC.

Victim entityDAVE INC.

Incidentdiscovered Jul 1, 2020

Stated responseDave’s security team quickly took steps to secure the company’s systems, including its customers’ accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov