HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
2gether USA
bd_12b91ff4fe72d4e5 · schema v1 · pii pii-v1
Full breach record for 2gether USA →2Gether Financial Services Inc. notified the Maryland Attorney General on January 28, 2025, regarding a data event affecting 7 Maryland residents. Unauthorized access occurred on or around August 1, 2023, and was discovered on August 7, 2023. The incident involved a third-party tax software provider. Affected data included names, Social Security numbers, driver's license numbers, and financial account information. 2Gether provided 12 months of credit monitoring via Experian and notified the IRS.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed7 affectedView incident
Source provenance
- Source URL
- https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376255.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 13, 2025
- Raw hash
- a952d22125879cf838fe86d64c7c9ea52b6e9376f3410e39cb61b83c36323b28
Reporting entity
- Name
- Mullen Coughlin LLCnorm: mullen coughlin
Victim entity
- Name
- 2gether USAnorm: 2gether usa
- Domain
- 2getherusa.com
Incident
- Discovered
- Aug 7, 2023
- Materiality determined
- —
- Notification sent
- Jan 28, 2025
- Affected individuals
- 7
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- providing written notice of this incident to relevant regulatorsnotified the IRS and provided them with information about the incident
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 28 months(829 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.