DisclosureLens
HackingCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsMediumContained

Divvy Up, Inc.

bd_dce576e28fc4ae62 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 18, 2021

Filed

Jul 30, 2021

To disclose

6 weeks

Affected · nationwide

38,50596 in this filing

Linked

15 filings

Confidence

50%
Full breach record for Divvy Up, Inc. →3 incidents on file

Divvy Up, Inc. reported an external system breach that occurred between May 10, 2021, and June 18, 2021. The breach was discovered on June 18, 2021. The compromised information includes names or other personal identifiers in combination with financial account numbers or credit/debit card numbers along with their security codes, access codes, passwords, or PINs. A total of 96 Maine residents were affected. Notification letters were sent to the affected individuals on July 30, 2021.

Maine clockDiscovered Jun 18, 2021 → Filed with AG Jul 30, 202142d ⏱ ME AG >30d6 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 39 days
discovery → filing · 6 weeks / 42 days

May 10, 2021

Begins

Jun 18, 2021

Discovered

Jul 30, 2021

Filed

This filing is one of 15 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Show 6 more filings ↓up to 88d gap

Showing first 10 of 14 linked disclosures.

Filing propagation · 11 filings · 7 states

View merged incident ↗
Indiana State AGMay 3 · first
Oregon State AGMay 3 · first
Montana State AGMay 3 · first
Maine State AG+1d
Massachusetts State AG+1d
Indiana State AG+88d
Massachusetts State AG+88d
California State AG+88d
Montana State AG+88d
Maine State AG+88d · this page
New Hampshire State AG+91d

Pattern: first filing May 3 (IN), last Aug 2 (NH) — a 91-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 14 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.