HackingFinancial ServicesTechnologyFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)CredentialsLowContained

TaxBit

bd_131b3c7c00a264f4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 23, 2023

Filed

Dec 19, 2023

To disclose

12 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for TaxBit →

TaxBit notified consumers of a data security incident involving a third-party web application. Unauthorized access may have occurred in late September 2023, potentially exposing names, email addresses, and read-only API keys. TaxBit engaged outside experts, notified impacted users on September 23, 2023, and recommended deleting and recreating API keys. No specific count of affected individuals was provided in the filing.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday12 weeks discovery → filing

⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Incident timeline

undetected · 22 days

discovery → filing · 12 weeks / 87 days

Sep 1, 2023

Begins

Sep 23, 2023

Discovered

Dec 19, 2023

Filed

vs. sector median

+4 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: TaxBit
norm: taxbit

Name: TaxBit
norm: taxbit
Industry: Financial ServicesllmTechnologyllm

Discovered: Sep 23, 2023
Breach occurred: Sep 1, 2023 – Sep 30, 2023
Undetected for: 22 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 23, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Initial access: supply_chain

During the incident: Investigated the incident with the assistance of outside experts
Notified individuals who were potentially impacted
Recommended that they delete and create new read-only API keys from exchange accounts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(87 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-12-19-taxbit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 19, 2023
Raw hash: 5e35fc603f371960303ee918af4b4ea8925ffa14937d2e8f4c73844fc0c7bdcd

Reporting entityTaxBit

Victim entityTaxBit

Incidentdiscovered Sep 23, 2023

Stated responseInvestigated the incident with the assistance of outside experts

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov