HackingTechnologyInformationStolen CredentialsCapture Stored DataCustomer Data InvolvedTargetedPCIFinancial accountLowContained

AthleteTrax LLC

bd_11096fd4b709b08a · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 5, 2024

Filed

Nov 22, 2024

To disclose

11 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for AthleteTrax LLC →2 incidents on file

AthleteTrax, LLC notified New Hampshire regulators that an unauthorized actor accessed its software between May 16 and September 5, 2024, inserting malicious code to scrape payment card data. The incident was discovered on September 5, 2024. Notices were sent to affected individuals, including those at Phillips Academy, on November 25, 2024.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 112 days

discovery → filing · 11 weeks / 78 days

May 16, 2024

Begins

Sep 5, 2024

Discovered

Nov 22, 2024

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: AthleteTrax LLC
norm: athletetrax

Name: AthleteTrax LLC
norm: athletetrax
Industry: Technologyllm

Discovered: Sep 5, 2024
Breach occurred: May 16, 2024 – Sep 5, 2024
Undetected for: 112 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 25, 2024
Affected individuals: Not disclosed
Data types: PCIFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: notifying regulators, as applicable
Initial access: exploit_public_facing

During the incident: Promptly began an investigation
Took steps to assess the security of the application and related AthleteTrax systems
Confirming the security of the relevant systems
Reviewing the potentially impacted data
Notifying potentially affected AthleteTrax customers
Notifying regulators, as applicable
Reviewing our existing policies and procedures
Changes made: Reviewing our existing policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(78 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/althletetrax-20241122.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 22, 2024
Raw hash: bb347fc26e52e2346e50c0d014f72117a61438085143557a90aef6b875da7c13

Reporting entityAthleteTrax LLC

Victim entityAthleteTrax LLC

Incidentdiscovered Sep 5, 2024

Stated responsePromptly began an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov