HackingTechnologyInformationVulnerability ExploitCapture Stored DataData ExfiltratedTargetedIdentity (basic)LowContained

TOO LOST LLC

bd_0879145c47f3fbf5 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 31, 2026

Filed

Feb 20, 2026

To disclose

20 days

Affected

Not disclosed

Linked

10 filings

Confidence

64%

Full breach record for TOO LOST LLC →

Too Lost notified consumers of a data breach involving unauthorized access to its web application between July 25, 2025, and September 2, 2025. The incident compromised basic contact information (name, address, email, phone). Too Lost engaged cybersecurity experts and law enforcement, confirmed data destruction by the attacker, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Vermont clock✓ VT AG ≤14 bday20 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 190 days

discovery → filing · 20 days

Jul 25, 2025

Begins

Jan 31, 2026

Discovered

Feb 10, 2026

Scope determined

Feb 20, 2026

Filed

vs. sector median

16 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

California State AGbd_2d71718d265351de2026-02-20Candidate
Indiana State AGbd_32c22f44949121742026-02-20Verified by operator
New Hampshire State AGbd_373b6de6cb19f9512026-02-20Verified
Nebraska State AGbd_4ad7e3b0d8858b932026-02-20Verified

Show 5 more filings ↓up to 34d gap

Maine State AGbd_54386167de42a9932026-02-20Verified
Indiana State AGbd_a10965c99e7afc612026-02-20Verified
Massachusetts State AGbd_b2c600e1387b37c42026-02-20Verified
Texas State AGbd_8bce7e39abf24b6e2026-03-16 · +24dVerified
New Hampshire State AGbd_979e794526725f7b2026-03-26 · +34dVerified

Name: TOO LOST LLC
norm: too lost
Domain: toolost.com

Name: TOO LOST LLC
norm: too lost
Domain: toolost.com
Industry: Technologyllm

Discovered: Jan 31, 2026
Breach occurred: Jul 25, 2025 – Sep 2, 2025
Undetected for: 190 daysoccurrence → discovery
Materiality determined: Feb 10, 2026
Notification sent: Feb 20, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: contacted law enforcement
Initial access: exploit_public_facing

During the incident: Launched a comprehensive investigation with the assistance of cybersecurity experts
Contacted law enforcement
Took steps to confirm that the data was destroyed by the unauthorized third party
Providing you with access to the identity protection services
Changes made: Made efforts to reduce the likelihood of a similar incident occurring in the future
Continue to make additional improvements that strengthen our cybersecurity posture
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: VT AG ≤14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 8 states

View merged incident ↗

California State AGFeb 20 · first

Indiana State AGFeb 20 · first

New Hampshire State AGFeb 20 · first

Nebraska State AGFeb 20 · first

Maine State AGFeb 20 · first

Indiana State AGFeb 20 · first

Massachusetts State AGFeb 20 · first

Vermont State AGFeb 20 · first · this page

Texas State AG+24d

New Hampshire State AG+34d

Pattern: first filing Feb 20 (CA), last Mar 26 (NH) — a 34-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2026-02-20-too-lost-data-breach-notice-consumer
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 20, 2026
Raw hash: 51f48fa589c1a92915a61a4ad199ac447fe4176c84a2ce024cbf2d40ef14b041

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityTOO LOST LLC

Victim entityTOO LOST LLC

Incidentdiscovered Jan 31, 2026

Stated responseLaunched a comprehensive investigation with the assistance of cybersecurity experts

ComplianceVT AG ≤14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov