HackingRetail & ConsumerRetailStolen CredentialsData MishandlingData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDFinancial accountCriticalContained

VOLKSWAGEN GROUP OF AMERICA, INC.

bd_dd6396c5997a49a4 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Mar 10, 2021

Filed

Jun 14, 2021

To disclose

14 weeks

Affected · nationwide

3,300,00013,233 in this filing

Linked

11 filings

Confidence

64%

Full breach record for VOLKSWAGEN GROUP OF AMERICA, INC. →3 incidents on file

Volkswagen Group of America (VWGoA) notified New Hampshire AG of a breach affecting 3.3 million US/Canadian customers. A vendor left data unsecured between Aug 2019 and May 2021. Data included contact info, VINs, and for ~90k individuals, driver's licenses, SSNs, and loan numbers. VWGoA engaged law enforcement and forensic consultants, offering 24 months of credit monitoring via IDX. Notification began June 11, 2021.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 587 days

discovery → filing · 14 weeks / 96 days

Aug 1, 2019

Begins

Mar 10, 2021

Discovered

Jun 14, 2021

Filed

vs. sector median

+6 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Indiana State AGbd_7e0baed1d7cb0dc92021-06-11 · +3dVerified
Delaware State AGbd_ace1b386f57a54322021-06-11 · +3dVerified
Montana State AGbd_f8e8f39ba9318f032021-06-11 · +3dVerified
Maine State AGbd_002ceb226a9ffd7e2021-06-10 · +4dCandidate

Show 6 more filings ↓up to 4d gap

California State AGbd_0941ba49b48318db2021-06-10 · +4dVerified
South Carolina State AGbd_1ddbf202e4f260d82021-06-10 · +4dVerified
Massachusetts State AGbd_84e55a939db554712021-06-10 · +4dVerified
Oregon State AGbd_a58d8faff4631eba2021-06-10 · +4dVerified
Hawaii State AGbd_a70d19886d56a8b92021-06-10 · +4dVerified
Idaho State AGbd_d051d73db23282c82021-06-10 · +4dVerified

Name: VOLKSWAGEN GROUP OF AMERICA, INC.
norm: volkswagen group of america

Name: VOLKSWAGEN GROUP OF AMERICA, INC.
norm: volkswagen group of america
Industry: Retail & Consumerllm

Discovered: Mar 10, 2021
Breach occurred: Aug 1, 2019 – May 1, 2021
Undetected for: 587 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 11, 2021
Affected individuals: 3,300,000state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Date of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: trusted_relationship

During the incident: Contacted federal law enforcement
Retained outside data analytics and cybersecurity consultants
Retained IDX to offer free credit protection services
Notifying affected individuals
Notifying the three major credit reporting agencies
Changes made: Conducting a full security review with the vendor to identify if further security enhancements are reasonable and appropriate
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(96 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Maine State AGJun 10 · first

California State AGJun 10 · first

South Carolina State AGJun 10 · first

Massachusetts State AGJun 10 · first

Oregon State AGJun 10 · first

Hawaii State AGJun 10 · first

Idaho State AGJun 10 · first

Indiana State AG+1d

Delaware State AG+1d

Montana State AG+1d

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/volkswagen-group-america-20210614.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 14, 2021
Raw hash: 45d0bf943ad471754c22ed7329580cb39302561e65c68c3d41a728a402f725e5

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityVOLKSWAGEN GROUP OF AMERICA, INC.

Victim entityVOLKSWAGEN GROUP OF AMERICA, INC.

Incidentdiscovered Mar 10, 2021

Stated responseContacted federal law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov