HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedData PublishedCustomer Data InvolvedIdentity (basic)Government IDCredentialsAuthenticationMediumContained

DAVE INC.

bd_e092890dc5d3fb2a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 1, 2020

Filed

Aug 21, 2020

To disclose

7 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

65%

Full breach record for DAVE INC. →

Dave, Inc. disclosed a data breach affecting customer records between June 23 and July 1, 2020, resulting from a compromise at a third-party service provider. The incident exposed names, emails, phone numbers, dates of birth, physical addresses, and encrypted Social Security numbers. Approximately 5,971 Rhode Island residents were specifically identified as affected. Dave notified the FBI, engaged forensic investigators, reset credentials, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 8 days

discovery → filing · 7 weeks / 51 days

Jun 23, 2020

Begins

Jul 1, 2020

Discovered

Aug 21, 2020

Filed

vs. sector median

1 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Indiana State AGbd_0a9d0fa37812e2742020-08-21Verified
New Hampshire State AGbd_d96b710b910f0da42020-08-21Verified
Washington State AGbd_5e95299fb85377f62020-08-20 · +1dVerified
California State AGbd_96afc6c3b4dc3c742020-08-20 · +1dVerified

Show 2 more filings ↓up to 233d gap

Oregon State AGbd_ea97508608d294232020-08-20 · +1dVerified
Illinois State AGbd_f91f5bf7f513a8f62020-01-01 · +233dCandidate

Name: DAVE INC.
norm: dave

Name: DAVE INC.
norm: dave
Industry: Financial Servicesllm

Discovered: Jul 1, 2020
Breach occurred: Jun 23, 2020 – Jul 1, 2020
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 21, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDCredentials
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement, including the Federal Bureau of Investigation ("FBI")
Initial access: supply_chain

During the incident: Retained a leading cybersecurity firm
Notified law enforcement, including the Federal Bureau of Investigation ("FBI")
Forced a reset of all customer login credentials
Requiring all customers to change their passwords
Put in place additional technical measures to enhance account security
Partnered with Mastercard ID Theft Protection to provide complimentary identity theft resolution services
Changes made: Ended relationship with the third-party service provider whose security breach enabled the unauthorized party to obtain your data
Put in place additional technical measures to enhance account security in consultation with independent cybersecurity experts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(51 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Illinois State AGJan 1 · first

Washington State AG+232d

California State AG+232d

Oregon State AG+232d

Indiana State AG+233d

New Hampshire State AG+233d

Delaware State AG+233d · this page

Pattern: first filing Jan 1 (IL), last Aug 21 (DE) — a 233-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2020/09/Dave-Inc-Template-notice-to-customers.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 21, 2020
Raw hash: 42cf62f7bf433fb73fb81c1b0aeb39ca8901bb33ef84da9c23fbb8c2c941d9cf

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityDAVE INC.

Victim entityDAVE INC.

Incidentdiscovered Jul 1, 2020

Stated responseRetained a leading cybersecurity firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov